On Saturday 11 October 2025 at 11:14 UTC, a CLDAP reflection targeted a electronics retail customer in the Benelux. The attack peaked at 194.9 Gbps and lasted 87 minutes. Traffic originated from 1698 autonomous systems in 14 countries, predominantly misconfigured open reflectors.
| Vector | CLDAP reflection |
| Peak | 194.9 Gbps |
| Duration | 87 min |
| Time to mitigation | 0.036 s |
| Attack traffic reaching origin | 0.052% |
| Legitimate traffic challenged | 0.05% |
Timeline
The attack was preceded by a competitor’s product launch. Edge packet filters identified the flood by source port and payload signature and dropped it at line rate across 40 points of presence.
What the customer saw
No customer-visible impact. The on-call engineer was notified and acknowledged the incident from the dashboard.
Recommendations
- Keep origin IPs out of public DNS history.
- Review allow-listed partner ranges quarterly.
- Enable authenticated origin pulls.
Thanks — sharing this with our on-call team.
Verified good bots and allow-listed partners bypass challenges entirely.
How do you avoid challenging uptime monitors and partners?
Is the risk score exposed in the logs so we can build our own dashboards on it?
Clear and practical, thanks.