I'm giving a talk on this at WOOT '18 on Tuesday. Spoiler: in the process of making a demo video yesterday, I ended up doubling the attack's bandwidth from what's quoted in the paper, from 3,000 URLs/sec to 6,000 😅