#DDoS

beesbuzz.biz

Futility

xkeeper posted a blog post about their issues running TCRF. On a related note, here’s my webserver’s HTTP response code stats for today, across all of my websites: fluffy@nautilus[/var/log/nginx] fluffy$ cut -f3 -d\" access.log | cut -f2 -d\ | sort | uniq -c | sort -n 3 408 4 502 4 503 10 410 20 504 56 307 60 403 165 406 225 401 462 499 662 405 670 500 819 202 1739 304 2989 400 6299 206 16352 302 32402 301 52673 404 83035 303 192512 200 308859 429 This is pretty disheartening. For those who don’t know, 429 is Too Many Requests, and is what my site responds with when it detects bad-behavior crawler activity, primarily from attempting to crawl over the tag browser, which is not presented to properly-declared bots (because there is no reason for bots to crawl them). So, of the nearly 700,000 requests served up today, around 44% were these crawler bots. Most of these bots come from residential proxy networks, meaning people have installed malware like Honeygain to earn tiny amounts of money for “Internet testing” or similar. Things are even worse, though. That 303 response code is See Other, which is a form of redirect that is used when you redirect a HTTP POST to a GET. There is only one place on my sites that such a thing happens: when someone presses the button for the “sentience check” that occurs on a 429 error page. When this button is clicked, the user gets a simple “button pressed” cookie that is signed with the user’s IP address and User-Agent and with a timestamp that expires after an hour. For a legitimate user who happened to trip the bot detection (by legitimately browsing multiple tags simultaneously), this will grant them access to the site. However, what’s actually happening here is that the crawlers are pretending to click the button so that they can try to access the site, but because each request comes from a different IP address or a randomized user-agent (trying to look like a real web browser), they end up just trying the same URL again and getting the same 429 response. So that’s another 12% of my website traffic going to bots who are specifically trying to get around my anti-bot measures. Back when I first started with this anti-bot measure I only checked for the presence of a cookie, under the presumption that the bots weren’t storing them at all, but one of the bots from the Alibaba cloud IP range did start to get through the check, indicating that it was storing _a_ cookie, and it was flooding my server with very expensive requests as a result. Signing it to the IP address stopped that, at least, but it hasn’t stopped the unrelenting onslaught, all the same. Okay, so HTTP 200 is the response code for an actual successful pageview. _At best_ that’s around 27.5% of my traffic. Let’s see how much of that is coming from declared bots: fluffy@nautilus[/var/log/nginx] fluffy$ grep ' 200 ' access.log | grep '+http' | wc -l 55024 So, of the 193,000 successful web requests, 29% is coming from bots that declare themselves to be bots. Let’s spot-check some of the other successful requests: x.x.x.x - - [07/Aug/2026:23:43:10 -0700] "GET /blog/everything?id=1643&tag=late-stage-capitalism HTTP/1.1" 200 3697 "https://beesbuzz.biz/blog/everything?id=1643&tag=late-stage-capitalism" "Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36" "beesbuzz.biz" https Okay so, this request is being made with its own URL as its referer, which legitimate browsers don’t do, but which bots do in order to try to look like real traffic while avoiding anti-hotlink protections. That’s harder to filter out with a simple command line. But spot-checking my access log, I see a lot of requests like that. I also see a lot of `ClaudeBot` requests. These do not properly declare themselves as bots, as they do not follow the `+http` convention for giving an informational page about the bot. They do provide a contact email address. The requests are all for nonexistent paths and seem to be probing for runtime configuration files and AWS credenetials and so on, so I doubt that these are _actually_ ClaudeBot. 35.205.29.241 - - [07/Aug/2026:23:47:38 -0700] "GET /@fs/.env?raw?? HTTP/1.1" 404 184 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])" "flrig.beesbuzz.biz" https 35.205.29.241 - - [07/Aug/2026:23:47:38 -0700] "GET /@fs/home/ubuntu/.aws/config?raw?? HTTP/1.1" 404 184 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])" "flrig.beesbuzz.biz" https 35.205.29.241 - - [07/Aug/2026:23:47:38 -0700] "GET /@fs/app/rootkey.csv?raw?? HTTP/1.1" 404 184 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])" "flrig.beesbuzz.biz" https 35.205.29.241 - - [07/Aug/2026:23:47:41 -0700] "GET /@fs/app/terraform.tfstate?raw?? HTTP/1.1" 404 184 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])" "flrig.beesbuzz.biz" https 35.205.29.241 - - [07/Aug/2026:23:47:41 -0700] "GET /@fs/var/www/.env?raw?? HTTP/1.1" 404 184 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])" "flrig.beesbuzz.biz" https 35.205.29.241 - - [07/Aug/2026:23:47:44 -0700] "GET /@fs/home/ubuntu/.azure/credentials?raw?? HTTP/1.1" 404 184 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])" "flrig.beesbuzz.biz" https 35.205.29.241 - - [07/Aug/2026:23:47:44 -0700] "GET /@fs/var/www/html/wp-config.php?raw?? HTTP/1.1" 404 184 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])" "flrig.beesbuzz.biz" https 35.205.29.241 - - [07/Aug/2026:23:47:44 -0700] "GET /@fs/root/.config/linode-cli?raw?? HTTP/1.1" 404 184 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])" "flrig.beesbuzz.biz" https 35.205.29.241 - - [07/Aug/2026:23:47:48 -0700] "GET /@fs/app/.openai/config.json?raw?? HTTP/1.1" 404 184 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])" "flrig.beesbuzz.biz" https 35.205.29.241 - - [07/Aug/2026:23:47:51 -0700] "GET /server/.env HTTP/1.1" 404 184 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])" "flrig.beesbuzz.biz" https Anyway. I don’t really have the energy to figure out a good test to find people who are legitimately browsing this site without doing much deeper analytics on IP addresses and so on, but I can safely say that very little of the traffic going to my server is fulfilling the purpose of putting my creative works online for other people to peruse. It’s disheartening. I spend so much time and energy and effort trying to make things that work well, and very little of it goes towards making a difference that matters. I am in a constant state of pain and fatigue, and try so very hard to do things that I care about with what little time and energy I can muster for it, but it all feels so futile. People keep telling me that AI is the future and you “can’t unsqueeze the tube of toothpaste” and so on, but what good is any of that shit doing? What good am _I_ doing? Why do I even bother? What’s the point to any of this?

www.nrk.no

Norsk Tipping utsatt for dataangrep

Norsk Tipping ble tirsdag kveld utsatt for et DDoS-angrep som gjorde nettsiden og appen utilgjengelig for brukerne. Angrepet ble oppdaget i 21-tiden tirsdag kveld, og etter en halvtimes tid fungerte systemene igjen som normalt. Klokken 22.20 bekreftet Pål Enger, leder presse og samfunnskontakt i Norsk Tipping, at angrepet var stoppet.

securityonline.info

Dysphoria Botnet Uses Blockchain Domains for C2 and Turns Victims Into Relays

At a glance Malware family Dysphoria (jackskid/fbot-derived IoT botnet) Threat actor Unattributed; run as a commercial DDoS-for-hire service Target About 200,000 IoT and embedded Linux devices worldwide, mostly routers, gateways, and IP cameras Delivery vector Telnet/SSH weak-credential brute force plus known IoT RCE exploits Key capabilities Multi-vector DDoS, blockchain ENS/SNS C2, victim-to-relay conversion, UPnP NAT traversal Source

www.nrk.no

Offentlige digitale løsninger - problemer skyldtes dataangrep

– Det har siden kl. 01 mandag 3. august pågått et tjenestenektangrep (DDoS) som rammer ID-porten som driftes hos Digdirs driftspartner Vivicta, skriver Digdir i en oppdatering på sine nettsider. DDoS-angrep fungerer ved å overbelaste systemer med trafikk slik at de krasjer eller blir utilgjengelige. – Dette påvirker flere av Digdirs løsninger og gjør at brukere opplever problemer med å logge inn til offentlige tjenester. Vi jobber med Vivicta om tiltak for å løse saken, skriver Digdir videre.

www.nrk.no

Offentlige digitale løsninger - problemer skyltes dataangrep

– Det har siden kl. 01 mandag 3. august pågått et tjenestenektangrep (DDoS) som rammer ID-porten som driftes hos Digdirs driftspartner Vivicta, skriver Digidir i en oppdatering på sine nettsider. DDoS-angrep fungerer ved å overbelaste systemer med trafikk slik at de krasjer eller blir utilgjengelige. – Dette påvirker flere av Digdirs løsninger og gjør at brukere opplever problemer med å logge inn til offentlige tjenester. Vi jobber med Vivicta om tiltak for å løse saken, skriver Digidir videre.

securityonline.info

Tengu Botnet Is a Modernized Mirai Variant That Fights to Stay on IoT Devices

At a glance Malware family Tengu (Mirai-derived IoT botnet) Threat actor Unattributed; no operator named Target Internet-facing embedded Linux devices, such as routers, cameras, and DVRs Delivery vector Telnet brute force, then a shell-script dropper over HTTP Key capabilities 25 DDoS methods, SOCKS5 proxy, recon, payload updates, persistence, self-defense Source Nozomi Networks Labs TL;DR Nozomi Networks Labs disclosed a new IoT botnet named Tengu on July 27, 2026.