How viable is this in the real world? I could imagine it working on a lone, quiet server at 4am with no other people on it. The average server with 100s of accounts, 1000s of users all doing various stuff, that's going to introduce enough random delay to throw off your analysis. Maybe you could try to calculate averages but that's going to increase the number of requests. Would a good hosting company block an attack like this at the hardware level? I'd guess yes, but I don't know.