I've been working on an automated triager for the frequent volumetric DDOS we see against www.bbc.com & www.bbc.co.uk.

The idea is to use our edge access logs (stored in BigQuery) to isolate & describe the attack traffic then recommend any additional mitigations/filters etc. It also gives us a database of DDOS metrics/sources we can reference.

Obviously I had to add the obligatory pew-pew map.

Looks like #NoName057 went after Israeli websites. Was it the first time? Any clues what could have provoked it?

Germany is NoName’s focus again today, with a mix of government websites and industrial/energy company sites being targeted.

About two thirds of the websites are affected so far. (And the two sites from the federal government are still standing, thanks to an anti-bot challenge/rate limiting.)

New configuration detected for DDosia. Hosts:
* group.vattenfall.com
* www.tunap.com
* www.pfleiderer.com
* www.schwarzbeck.de
* www.vng.de
* shop.semikron-danfoss.com
* carl-walther.de
* www.mc-bauchemie.de
* eshop.tunap.de
* cvd.bundesregierung.de
* www.semikron-danfoss.com
* www.sefe-energy.eu
* www.bundesregierung.de
* www.vattenfall.de
* still.de
* www.meyle.com #ThreatIntel #Ddosia #NoName
* https://witha.name/data/2024-12-17_07-35-02_DDoSia-target-list-full.json
*

Shockingly high effectiveness today — most sites are down.

Not much media but German industrial sector targeted today by NoName (and extra malus points for targeting Auticon, an IT firm that hires folks on the autism spectrum).

NoName is getting its volunteers to do some reconnaissance on German media websites: