On Monday 14 June 2021 at 23:36 UTC, a CLDAP reflection targeted a video streaming customer in North America. The attack peaked at 353.7 Gbps and lasted 45 minutes. Traffic originated from 1538 autonomous systems in 25 countries, predominantly a Mirai-derived IoT botnet.
| Vector | CLDAP reflection |
| Peak | 353.7 Gbps |
| Duration | 45 min |
| Time to mitigation | 0.904 s |
| Attack traffic reaching origin | 0.028% |
| Legitimate traffic challenged | 0.05% |
Timeline
The attack was preceded by a ransom note demanding payment in Monero. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 13 points of presence.
What the customer saw
The customer’s status page stayed green throughout; they learned about the attack from our notification.
Recommendations
- Keep origin IPs out of public DNS history.
- Enable log streaming to your SIEM for faster correlation.
- Lower challenge thresholds on authentication endpoints during high-risk events.
We had the exact false-positive issue with CGNAT carriers. The weighting change makes sense.
How does the proof-of-work challenge behave on older Android devices? Any numbers below Android 10?
Do you publish the edge IP ranges in a machine-readable format?
Is the risk score exposed in the logs so we can build our own dashboards on it?
Great to hear, thanks for sharing your experience.