Volume is a signal too
No single request is malicious — but hammer a sensitive endpoint and ITDR notices anyway.
- 1
Fire 15 rapid step-up requests at /api/stepup/totp.
Each one is individually harmless — a wrong TOTP code, nothing more. The rate limiter (10/minute) starts returning 429 well before you finish.
- 2
Watch the throttled hits pile up in the log below.
Every 429 emits ratelimit.throttled — the SAME event the P6 rate-limit practical produces, just fired repeatedly instead of once.
- 3
The 3rd throttle in ten minutes crosses a NEW detector’s threshold.
Unlike P14’s single-shot token-reuse detector, this one is volume-based: no one request is the smoking gun, but a sustained burst of 429s is exactly what probing or credential-stuffing looks like from the rate limiter’s seat.
Do it
The step-up endpoint allows 10 requests/minute. Fire 15 wrong-code attempts — no single one matters, but the volume does.
The limiter counts per fixed clock minute, so if the burst happens to straddle a minute boundary it can split into two under-the-limit halves and throttle nothing. If you see no 429s, press the button again — the second burst starts at a different offset.
Learn the theory
🩻 X-ray — what actually happened
Your own insert-only audit trail — the real server events, sanitized (never a secret), each linked to the lesson that explains it.