On Tuesday 6 January 2026 at 22:14 UTC, a CLDAP reflection targeted a education platform customer in Western Europe. The attack peaked at 57.5 Gbps and lasted 104 minutes. Traffic originated from 1105 autonomous systems in 30 countries, predominantly a rented booter service.
| Vector | CLDAP reflection |
| Peak | 57.5 Gbps |
| Duration | 104 min |
| Time to mitigation | 0.700 s |
| Attack traffic reaching origin | 0.083% |
| Legitimate traffic challenged | 0.32% |
Timeline
The attack was preceded by a ransom note demanding payment in Monero. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 18 points of presence.
What the customer saw
The customer’s status page stayed green throughout; they learned about the attack from our notification.
Recommendations
- Keep origin IPs out of public DNS history.
- Lower challenge thresholds on authentication endpoints during high-risk events.
- Review allow-listed partner ranges quarterly.
How does the proof-of-work challenge behave on older Android devices? Any numbers below Android 10?
How do you avoid challenging uptime monitors and partners?
Good question. We will cover that in a follow-up post.
Nice to read a vendor blog that admits what went wrong.