Assessing the Aftermath: the Effects of a Global Takedown against...
summary
Analysis uses web traffic, chat crawls, and attack logs from Hopscotch, Ampot, NESCO and industry self-reports to quantify a multinational action that seizes 49 domains in Dec 2022 and 13 in May 2023, uses deceptive splash pages and seized infrastructure, and tracks API calls. Findings show over half of seized sites return with a median one to two day return, resurrected domains see 80–90% traffic reduction, the first wave cuts global DDoS volume by roughly 20–40% (strongest on UDP), and measurable effects last about six weeks.
AI-written summary · about
chapters (11)
- 0:00DDoS-for-hire takedowns intro
- 1:40How DDoS-for-hire works
- 3:56Law enforcement global takedowns
- 5:39Measuring impact data sources
- 6:00Takedown domains resurrect fast
- 7:25Supply impact on DDoS-for-hire
- 8:30Telegram activity after takedowns
- 9:33Global attack volume trends
- 11:16UDP vs TCP attack changes
- 12:42Short-lived vs long-term impact
- 13:25Peak attack mitigation
related talks
37mAnatomy of a DDoS
56mDismantling DDoS - Lessons in Scaling
52mInvestigating DDOS - Architecture Actors and Attribution
32mSomething’s Phishy: See the Hook Before the Bait
45mAnatomy of a DDoS
48mDawn Of The Dead: The Tale Of The Resurrected Domains
25mDark Side of the DNS Force
47mAgents of Chaos: Hacktivism Spreads Fear, Disinformation, and Propaganda