A leading national automotive marketplace was absorbing thousands of malicious requests every hour — bot floods from overseas IP ranges scraping inventory data, credential-stuffing attacks targeting dealer portals, and targeted DDoS probes aimed at peak listing windows. Revenue-per-listing was eroding as real buyers encountered slow load times and failed transactions.
The platform served 8 million active listings across India, with dealer dashboards and consumer search running on the same origin. Protecting one without throttling the other had proved impossible with existing on-premise WAF appliances — rules written for the portal kept blocking legitimate search crawlers, while rules tuned for search let bot traffic through to dealer APIs.
The client needed a security layer that could distinguish a Hyderabad-based buyer browsing evening inventory from an automated bot cluster in Eastern Europe mimicking the same request patterns — and make that decision in under 5 ms at the CDN edge, without adding a round-trip to origin.
Their existing infrastructure team had already attempted two WAF migrations over 18 months, both rolled back after legitimate traffic was blocked during high-traffic flash sales. Trust in automated security was low. Any new solution needed a zero-regression path to production.
Goognu's AWS security practice began with a two-week traffic analysis phase — ingesting 30 days of CloudFront access logs into Amazon Athena to map request signatures, geographic distributions, and rate patterns by endpoint class. This produced an evidence-based threat model before a single rule was written.
We deployed AWS Managed Rule Groups as a baseline — AWS Core Rules, Known Bad Inputs, and the IP Reputation List — then added three custom rule groups tuned specifically to automotive marketplace traffic: inventory scraper signatures, dealer API rate limits by authenticated session, and geographic IP blocks targeting the 14 countries identified as high-risk in the traffic analysis.
Rather than blunt country-level blocks, we built geo-blocking rules with authenticated-session carve-outs. NRI buyers logging in from the UAE or UK bypass the geo-block entirely. Unauthenticated requests from flagged regions are redirected to a CAPTCHA challenge rather than hard-blocked, preserving legitimate intent while eliminating automated traffic.
All new rules ran in Count mode for two weeks in parallel with the live WAF — logging every match without blocking. The Goognu team reviewed daily Athena dashboards comparing shadow matches against confirmed-legitimate sessions to validate zero false-positive overlap before switching to Block mode.
For the dealer portal endpoints — the highest-value attack surface — we onboarded Shield Advanced with proactive DDoS response support. Automatic application-layer detection is now paired with 24/7 DRT access, reducing mean-time-to-mitigation for volumetric attacks from 47 minutes to under 3 minutes.
Eight weeks after go-live, the client measured the following improvements against their 90-day pre-deployment baseline.
"Previous vendors promised protection and delivered blocked customers. Goognu's shadow-testing methodology gave us the confidence to flip to Block mode without losing a single flash sale. The precision was unlike anything we'd seen."— VP Engineering, National Automotive Marketplace (name withheld)
The solution is fully managed through AWS-native services, with IaC-driven rule updates deployed via CI/CD — no manual rule editing, no change-window risk.