← Problem Library
Security L5 SECURITY-1255 · 17 min

Password spray continues despite rate limiting because IPv6 privacy address rotation defeats the IP-only throttle key

The control is active, yet abuse persists because the identity chosen for throttling is too cheap for attackers to rotate around.

SecurityPlatform ReliabilityLevel 5Pro17 min
Scenario

An authentication surface limits by source IP and still suffers sustained password spraying from clients rotating IPv6 addresses.

What to check first
  • Identify the primary failure signal in the IPv6 Rotates Past IP-Only Throttle scenario.
  • Separate visible symptoms from the underlying technical dependency.
  • Describe the safest recovery path and the follow-up prevention work.
Checking checklist
  1. Summarize the current impact and the last known change.
  2. Collect direct evidence from logs, runtime state, and configuration before changing anything.
  3. Separate immediate recovery from permanent prevention work.
Recovery and prevention

Strengthen the throttle identity model instead of only tuning thresholds.

Questions worth viewing together
What should you verify first when Password spray continues despite rate limiting appears?

Community-field security problem inspired by public discussions where IPv6 privacy address rotation bypassed IP-only authentication throttling. A rate limiter can function exactly as designed and still be ineffective if it keys on the wrong identity surface.

What usually causes Password spray continues despite rate limiting in production?

Teams often think the limiter is broken when attackers are simply rotating around an overly narrow key.

What should you document after resolving Password spray continues despite rate limiting?

Modern address rotation makes naive IP-based auth throttling much weaker than it first appears.