#CENTR #dDoS Interesting talk since it was not a talk: after a short introduction, people in the room were told to gather in small groups (with no group hving two persons from the same domain registry), discuss on one of the proposed statements, and synthetize their discussion at the end.
Everybody agrees that we should share more information (heard many times in the last 25 years at CENTR...)
#CENTR #DNS #dDoS "Towards a more effective strategy to deflect DDoS attacks on critical DNS anycast infrastructure"
With a DNSCON scale for problems (DNSCON 5 is all good, DNSCON 2, you start RTBH, DNSCON 1 is complete failure, see info on https://status.sidn.com).
DDoS Alert
AnonSec claim to have taken down 5 Israeli Government websites.
The websites seem to be down at this moment.
Actor: AnonSec
Method: #DDoS
Date: April 7, 2025
KrebsOnSecurity Hit With Near-Record 6.3 Tbps DDoS
https://krebsonsecurity.com/2025/05/krebsonsecurity-hit-with-near-record-6-3-tbps-ddos/
#U.S.DepartmentofJustice #InternetofThings(IoT) #KaikeSouthierLeite #Ne'er-Do-WellNews #ALittleSunshine #TheComingStorm #DamianMenscher #DDoS-for-Hire #ProjectShield #Aisurubotnet #Breadcrumbs #QiAnXinXLab #CloudFlare #stresser #Akamai #booter #Jigsaw #Forky #mirai #yfork #DDoS #fbi
ByWater is reporting that scraper bots are inadvertently(?) DDoSing several systems.
So that's fun.
After the last time we set up Cloudflare captchas, but it's still causing slowness.
Pretty much the only regions on the planet from which we *don't* see regular volumetric DDOS against www.bbc.co.uk & www.bbc.com is central Africa & the poles.
This is map shows the number of time each country was a DDOS traffic source in the last 30 days (larger circles == more DDOS attacks).
The botnets are really well globally distributed these days (and we typically see thousands or tens of thousands of source IPs per attack - mostly compromised servers).
@briankrebs yeah, cuz every #SecOps of any #ISP is gonna read that and look into the affected hosts if they were in their netwirk and obviously share the findings with investigators.
So everyone but the malicious actor is gonna be mad...
@Npars01 and even then to me this looks more like a "bad" #PR stunt to me.
It's the digital equivalent of kids shooting paintballs at a parked cop car in a monsoon rain and that got only noticed retroactively...
Like even if they had succeeded, what would've been the outcome? Maybe line that reads: "Congrats Kiddo, you just wasted thousands if not millions of dollars worth in Monero just to create an outage of a tiny blog. Go give yourself a star in your exercise book!"…
@briankrebs TBH, I think #DDoS'ing your blog is kinda wasteful beyond "#BraggingRights" because it's not only well protected but the amount of damage / revenue by #blackmailing they could expect is just zero.
But there are thousands if not millions of weaker targets they could've attacked.
Pretty shure had #Google not told you or anyone else you would not have even noticed it.
Meanwhile at $DAYJOB we have routers being pounded into catatonia by VPN credstuffers on $US-HOSTER and $EU-HOSTER who seem to not have noticed that we want an all-important 2nd factor. (yeah, can't name them. they are who you'd expect)
Gee, I hope no legitimate #SpamAssassin users are trying to get to RuleQA from these places...
Prefix: 94.74.80.0/20
Prefix: 101.44.176.0/20
Prefix: 111.119.192.0/20
Prefix: 159.138.96.0/20
Prefix: 166.108.192.0/20
Prefix: 188.239.32.0/20
Add this to the list of ADDITIONAL REASONS I hate AI.
They're absolutely slamming websites on the Internet so they can suck the contents into their great big training databases.
Ahhh. Recently one of my work sites was found by an aggressive Brazilian scraping bot (possibly ai scanning). So @cadey to the rescue with Anubis (https://anubis.techaro.lol)! 
@aredridel I merely use #GitHub because it's too big to get #DDoS'd, it's free and they actually give a shit re: abuse reports!
After I published a recent article where I showed how to mitigate an accidental DDoS after enabling ActivityPub for WordPress with the Surge plugin, I found an optimization for improved cache handling. Out of the box, there’s a problem with the default configuration since Surge ignores the Accept header.
[…]
https://epiph.yt/en/blog/2025/optimize-surge-configuration-for-activitypub/
IoT devices turned into DDoS slaves? 
Sounds wild, right? But it's totally true! Think GeoVision, Samsung... and that's just scratching the surface, really. Those End-of-Life devices? They're practically a free-for-all for botnet operators. Mirai sends its regards! 
So, what's the big deal? Well, IoT gadgets often have lousy security, and updates? Forget about 'em! Automated scans? They barely scratch the surface. If you want real security, you gotta go for manual pentests. 
Alright, so what can you actually do? Update 'em (if that's even an option!), segment your network, and keep an eye on things with monitoring! An unpatched device? That's a ticking time bomb, plain and simple. 
And hey, don't forget: vendor security claims are often just a load of marketing fluff! 
Which "smart" devices with known weak spots are hiding out on your network? Have you even checked lately? 
https://www.europesays.com/2058741/ DDoS-for-Hire Empire Dismantled As Poland Arrests 4 Admins #Aktualności #CBZC #DDoS #DDoSForHire #Europol #OperationPowerOFF #poland #polska #PowerOFF #TheCyberExpress #TheCyberExpressNews #US
@jherazob @leberschnitzel they already exist...
I think it's bad #TechPopulism to think that #Anubis will fix all the issues.
Just block all the #GAFAMs ASNs & #hosters that host #Scrapers so the industry cracks down harder on them than on #IRC, #Tor #ExitNodes, #CSAM & #BitTorrent combined!
Shure: https://en.wikipedia.org/wiki/Dread_(forum)
Another Forum that has implemented good Anti-DDoS seems to be BreachForums
One does have to admit they are able to do #DDoS-#protection w/o value-removing middlemen, #JavaScript and #BrowserFingerprinting…
@varbin @f4grx @nixCraft @torproject Well, you can dynamically block them based off packet rate & amount of requests and rate-limit them as well as limit them in terms of transfer rate.
Not to mention you rarely see DDoS attacks from residential IPs and ISPs are quick to disconnect offending hosts upon reporting them, so worst-case one blocks a /24 for 24 hours.
Again: if this is a real problem, any decent datacenter / hoster / upstream will gladly pick up the phone or reply to your support request via mail.
#DECIX even officially recommends that as a means to handle large-scale DDoS attacks and keep everyone else online.
️
Bill Cole 
