On Thursday 21 October 2021 at 22:41 UTC, a CLDAP reflection targeted a municipal services customer in Iberia. The attack peaked at 167.0 Gbps and lasted 33 minutes. Traffic originated from 642 autonomous systems in 118 countries, predominantly a rented booter service.
| Vector | CLDAP reflection |
| Peak | 167.0 Gbps |
| Duration | 33 min |
| Time to mitigation | 0.297 s |
| Attack traffic reaching origin | 0.009% |
| Legitimate traffic challenged | 0.01% |
Timeline
The attack was preceded by a hacktivist channel announcing the target. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 21 points of presence.
What the customer saw
A brief increase in p99 latency of 59 ms during the first minute, then normal service.
Recommendations
- Add a dedicated rate limit for the targeted route.
- Keep origin IPs out of public DNS history.
- Enable authenticated origin pulls.
Interesting that most attacks are under ten minutes. Our experience is similar.
The point about origin IPs leaking through certificate transparency logs is underrated.
How do you avoid challenging uptime monitors and partners?
How does the proof-of-work challenge behave on older Android devices? Any numbers below Android 10?
Machine-readable ranges are at /ips.json and via the API.