On Monday 16 June 2025 at 10:51 UTC, a CLDAP reflection targeted a electronics retail customer in the Benelux. The attack peaked at 167.0 Gbps and lasted 117 minutes. Traffic originated from 3897 autonomous systems in 80 countries, predominantly a rented booter service.
| Vector | CLDAP reflection |
| Peak | 167.0 Gbps |
| Duration | 117 min |
| Time to mitigation | 0.167 s |
| Attack traffic reaching origin | 0.084% |
| Legitimate traffic challenged | 0.65% |
Timeline
The attack was preceded by no stated motive. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 40 points of presence.
What the customer saw
Checkout conversion was unchanged compared with the same hour of the previous week.
Recommendations
- Lower challenge thresholds on authentication endpoints during high-risk events.
- Keep origin IPs out of public DNS history.
- Enable log streaming to your SIEM for faster correlation.
Our auditors asked for exactly this kind of incident evidence under DORA.
How do you avoid challenging uptime monitors and partners?
Solid runbook advice. The DNS-at-2am point hit home.
Do you publish the edge IP ranges in a machine-readable format?
We moved from a scrubbing provider to always-on last year; time to mitigation went from minutes to basically nothing.