A large US marketplace platform
Restoring a large US marketplace by blocking DDoS request patterns and repairing a third-party payment-link flow that allowed unbounded URL generation without authentication.
What this engagement was
A large marketplace platform in the United States was experiencing critical downtime from compounding traffic and application faults. Soludome analysed requests through the web application firewall, identified and blocked the DDoS patterns, and repaired a third-party payment flow that allowed links to be generated repeatedly without authentication. Server load fell and platform performance improved after the work.
- Client
- Confidential — US marketplace platform
- Sector
- Marketplace
- Location
- United States
- Engagement
- Security and platform stability recovery
- Relationship
- Began around 2020; occasional support continues
- Focus
- DDoS, payment-link security, server load and memory management
What was going wrong
The platform was under pressure from both hostile traffic and defects inside the application. DDoS requests disrupted availability while a third-party payment-link flow accepted unauthenticated requests. The generated URLs persisted and the flow could be invoked repeatedly, producing an unbounded number of links, memory leaks and unnecessary server load.
A marketplace has to remain available to buyers and sellers at the same time. Recovery therefore required two different interventions: filtering hostile request patterns at the WAF and correcting the payment integration so unauthenticated requests could no longer create URLs indefinitely.
What we established
The reported symptom is frequently two layers above the cause. These are the findings that shaped the work.
WAF traffic exposed repeatable DDoS patterns
Request analysis in the web application firewall showed recurring patterns that stood apart from normal marketplace traffic and could be blocked directly.
The payment integration did not authenticate link generation
The marketplace connected to a third-party platform for payment processing, but the payment-link generation path could be called without first authenticating the requester.
Persistent URLs could be generated without a limit
The generated links remained in the system and the path could be invoked repeatedly, creating an unbounded set of URLs that contributed to memory leaks and elevated server load.
How we worked
Including the sequencing decisions, which are usually where the work succeeds or has to be repeated.
Analyse requests at the WAF
Reviewed traffic patterns and individual requests through the web application firewall until the attack signatures could be separated from legitimate marketplace activity.
Block the identified attack patterns
Added WAF controls for the request patterns identified during analysis, reducing the hostile traffic reaching the application.
Repair payment-link generation
Corrected the third-party payment flow so links could no longer be generated through repeated unauthenticated requests, closing the path behind the unbounded URLs and memory leaks.
What was built or changed
Scope of work, grouped by area.
Traffic and availability
- WAF request-pattern analysis
- DDoS request patterns blocked
- Critical downtime addressed
Application remediation
- Third-party payment-link integration corrected
- Unauthenticated link generation resolved
- Unbounded URL creation and associated memory leaks addressed
What made it difficult
The technical and operational constraints that shaped the work.
Attack traffic and application faults both increased load
The server saw pressure from the DDoS requests and the faulty payment-link path at the same time. Recovery depended on isolating both rather than assuming one explained every symptom.
The vulnerable path crossed a third-party boundary
Payment processing depended on an external platform, while the marketplace controlled how link-generation requests reached it. The correction had to preserve payments while closing unauthenticated generation.
Persistent links made the problem cumulative
Generated URLs stayed in the system and requests could create more indefinitely, so memory use and server demand grew with repetition rather than ending with a single request.
What the work produced
Soludome identified and blocked the DDoS request patterns through the WAF, then corrected the unauthenticated third-party payment-link flow responsible for unbounded persistent URLs and memory leaks. Server load decreased and platform performance improved. The initial recovery began around 2020; the client now returns for occasional support rather than operating under a continuous engagement.
“By far they are the best custom service developer provider. They are patient and experts in multiple areas. They know all the ins and outs of the field they specialise in.”
The lasting difference
Durable structural change rather than a one-off improvement — which is what a client is actually buying.
- DDoS request patterns identified in WAF traffic were blocked.
- Third-party payment links could no longer be generated through the same unauthenticated path.
- Unbounded persistent URL creation and its associated memory leaks were resolved.
- Server load decreased and marketplace performance improved.
Capabilities used and related work
Have a system with a similar problem?
Tell us what it is doing. The diagnosis is usually the part that has been missing.