06.28.15

Gemini version available ♊︎

DDOS Attacks Against Techrights

Posted in Site News at 9:03 pm by Dr. Roy Schestowitz

Knocking the site over intentionally

Chess board

Summary: Information about some of the most recent DDOS attacks against this Web site and the steps to be taken next

THERE is a long history of DDOS attacks against Techrights, going back to 2008 or thereabouts. There were also press articles about DDOS attacks against the site (based on evidence provided to journalists upon request). Pinpointing who’s to blame for an attack is a lot harder than combating an attack (one way or another) and holding someone accountable is virtually impossible. People don’t just give themselves away so willing.

Over the past week there was a new pattern of DDOS attacks and they came from AWS servers, so I was able to file abuse reports and pursue this complaint (still work in progress). At this stage I am still hoping to see who or what group (or company) is behind it. This is clearly malicious.

Over the past few months I lost a lot of time (maybe hundreds of hours) due to DDOS attacks. It’s financially damaging and emotionally exhausting. I have been privately advised to file a report with the Dutch authorities over various DDOS attacks, which some told me might be connected to the EPO (or particular high-level staff at the EPO). Nonetheless, these efforts are usually a waste of time (I last tried around 8 years ago), so I did not bother. It’s a patience-draining experience that usually yields no results at all. It’s mostly symbolic. I did plan to write about this at some later stage and I even told one person that I might write more about intricate details of the attacks one day, maybe after the storm is settled at the EPO (giving too much information away usually helps the attacker). Today I would like to share some information about recent DDOS attacks and patterns that were noticed. This is information that won’t help the attacker; rather, it might discourage the attacker.

Referring to our DDOS complaints (IP addresses of the EPO hammering on our server quite heavily) and my recent “tweet”, one person told me that “The EPO IU is based in Munich but that doesn’t really tell you anything about what IP addresses are going to appear on traffic from the EPO.

“As far as [I'm] informed much of the EPO’s IT infrastructure is located in the Hague (Rijswijk) office. So even Internet traffic from Munich may be routed through a proxy in the Hague and appear with a Netherlands IP address. In any case the IU (in Munich) could presumably delegate tasks to an IT department (which could be based in the Hague).

“But the fact that you seem to be identifying IP addresses assigned to the EPO is in itself revealing.

“A lot of EPO addresses begin with 145.64 [...] You can find many of the address blocks in the db-ip.com database. For example: https://db-ip.com/all/145.64.0

“But it’s important to note that the geographical location nominally associated with the EPO IP address (e.g. Rijswijk/Hague) doesn’t really tell you where the user of the IP address is physically located (e.g. whether in Munich or the Hague).”

More technical information about the nature of the DDOS-induced strain can be published when the storm at the EPO is over. I can only speculate about who’s behind the attacks and weigh the probabilities. There is no ‘smoking gun’ just yet.

Some things, like the nature of attacks on this site, can be published upon key events, such as key facts about SIPO/Željko Topić corruption being published after a defamation trial reveals that allegations have merit and are most likely true. It would be safer for Techrights to limit sharing of information temporarily and to do so (against accusations or retaliatory tactics) only until perceived foes are powerless and widely scrutinised.

“You could try filing a criminal complaint with the Dutch authorities,” one person told me. “It seems that they have take action against DDOS attacks in the past.

“The EPO will probably try to hide behind its “immunity” but that should not protect it in this case as DDOS is not part of its official functions.”

DDOS attacks are very hard to analyse for original sources, speaking as a system administrator here. As far back as pre-2010 I have tried complaining to British authorities and it never led to the slightest of actions. They don’t even know what DDOS means, until or unless it attacks some major business or a governmental institution. Experience teaches that it’s a waste of time to even initiate action and I already have a big battle with BT (since March) and another one brewing with Amazon (over the latest DDOS against Techrights). Amazon will hopefully unmask (perhaps under increasing pressure) the identity of the account behind it all. This needs to happen soon, maybe this week.

“You may be right,” wrote to us another person with some background in this area. “It’s probably easier just to block the addresses.” Well, it’s not always possible, not with AWS anyway (far too many IP addresses).

Speaking again with one who is familiar with the EPO’s network, I begin to consider filing a complaint directly with the EPO. “As mentioned previously,” wrote to us one person, “as far as we can determine, most officially registered EPO addresses begin with 145.64.

“See here: http://bgp.he.net/AS28756#_prefixes

“Also here: https://ipinfo.io/AS28756

The E-mail addresses listed for the Network Administrators at the EPO under the second link above are rather clear.

ywoue@epo.org and wherler@epo.org (that’s Wolfgang Herler) will soon be contacted.

We found two further E-mail addresses here: jbielsa@epo.org and nderuiter@epo.org (that’s Niek de Ruiter).

There is also an “impersonal” E-mail address for Network Administration: admin_network@epo.org

Once I get to the bottom of the DDOS attacks from Amazon AWS I may also make time to file a detailed complaint to the above addresses, complete with a list of offending EPO IP addresses (which automatically got banned by our security software/defences, based on their erratic behaviour).

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New


  1. Daniel Stenberg Knows Almost Nothing About Gemini and He's Likely Just Protecting His Turf (HTTP/S)

    The man behind Curl, Daniel Stenberg, criticises Gemini; but it's not clear if he even bothered trying it (except very briefly) or just read some inaccurate, one-sided blurbs about it



  2. Links 29/05/2023: Videos Catchup and Gemini FUD

    Links for the day



  3. Links 28/05/2023: Linux 6.4 RC4 and MX Linux 23 Beta

    Links for the day



  4. Gemini Links 28/05/2023: Itanium Day, GNUnet DHT, and More

    Links for the day



  5. Links 28/05/2023: eGates System Collapses, More High TCO Stories (Microsoft Windows)

    Links for the day



  6. IRC Proceedings: Saturday, May 27, 2023

    IRC logs for Saturday, May 27, 2023



  7. No More Twitter, Mastodon, and Diaspora for Tux Machines (Goodbye to Social Control Media)

    People would benefit from mass abandonment of such pseudo-social pseudo-media.



  8. Links 28/05/2023: New Wine and More

    Links for the day



  9. Links 27/05/2023: Plans Made for GNU's 40th Anniversary

    Links for the day



  10. Social Control Media Needs to be Purged and We Need to Convince Others to Quit It Too (to Protect Ourselves as Individuals and as a Society)

    With the Tux Machines anniversary (19 years) just days away we seriously consider abandoning all social control media accounts of that site, including Mastodon and Diaspora; social control networks do far more harm than good and they’ve gotten a lot worse over time



  11. Anonymously Travelling: Still Feasible?

    The short story is that in the UK it's still possible to travel anonymously by bus, tram, and train (even with shades, hat and mask/s on), but how long for? Or how much longer have we got before this too gets banned under the false guise of "protecting us" (or "smart"/"modern")?



  12. With EUIPO in Focus, and Even an EU Kangaroo Tribunal, EPO Corruption (and Cross-Pollination With This EU Agency) Becomes a Major Liability/Risk to the EU

    With the UPC days away (an illegal and unconstitutional kangaroo court system, tied to the European Union in spite of critical deficiencies) it’s curious to see EPO scandals of corruption spilling over to the European Union already



  13. European Patent Office (EPO) Management Not Supported by the EPO's Applicants, So Why Is It Still There?

    This third translation in the batch is an article similar to the prior one, but the text is a bit different (“Patente ohne Wert”)



  14. EPO Applicants Complain That Patent Quality Sank and EPO Management Isn't Listening (Nor Caring)

    SUEPO has just released 3 translations of new articles in German (here is the first of the batch); the following is the second of the three (“Kritik am Europäischen Patentamt – Patente ohne Wert?”)



  15. German Media About Industry Patent Quality Charter (IPQC) and the European Patent Office (EPO)

    SUEPO has just released 3 translations of new articles in German; this is the first of the three (“Industrie kritisiert Europäisches Patentamt”)



  16. Geminispace Continues to Grow Even If (or When) Stéphane Bortzmeyer Stops Measuring Its Growth

    A Gemini crawler called Lupa (Free/libre software) has been used for years by Stéphane Bortzmeyer to study Gemini and report on how the community was evolving, especially from a technical perspective; but his own instance of Lupa has produced no up-to-date results for several weeks



  17. Links 27/05/2023: Goodbyes to Tina Turner

    Links for the day



  18. HMRC: You Can Click and Type to Report Crime, But No Feedback or Reference Number Given

    The crimes of Sirius ‘Open Source’ were reported 7 days ago to HMRC (equivalent to the IRS in the US, more or less); but there has been no visible progress and no tracking reference is given to identify the report



  19. IRC Proceedings: Friday, May 26, 2023

    IRC logs for Friday, May 26, 2023



  20. One Week After Sirius Open Source Was Reported to HM Revenue and Customs (HMRC) for Tax Fraud: No Response, No Action, Nothing...

    One week ago we reported tax abuses of Sirius ‘Open Source’ to HMRC; we still wait for any actual signs that HMRC is doing anything at all about the matter (Sirius has British government clients, so maybe they’d rather not look into that, in which case HMRC might be reported to the Ombudsman for malpractice)



  21. Links 26/05/2023: Weston 12.0 Highlights and US Debt Limit Panic

    Links for the day



  22. Gemini Links 26/05/2023: New People in Gemini

    Links for the day



  23. IRC Proceedings: Thursday, May 25, 2023

    IRC logs for Thursday, May 25, 2023



  24. Links 26/05/2023: Qt 6.5.1 and Subsystems in GNUnet

    Links for the day



  25. Links 25/05/2023: Mesa 23.1.1 and Debian Reunion

    Links for the day



  26. Links 25/05/2023: IBM as Leading Wayland Pusher

    Links for the day



  27. IRC Proceedings: Wednesday, May 24, 2023

    IRC logs for Wednesday, May 24, 2023



  28. Links 25/05/2023: Istio 1.16.5 and Curl 8.1.1

    Links for the day



  29. Gemini Links 25/05/2023: On Profit and Desire for Gemini

    Links for the day



  30. SiliconANGLE: Sponsored by Microsoft and Red Hat to Conduct the Marriage Ceremony

    SiliconANGLE insists that paying SiliconANGLE money for coverage does not lead to bias, but every sane person who keeps abreast of SiliconANGLE — and I read their entire feed every day — knows that it’s a ludicrous lie (Red Hat/IBM and the Linux Foundation also buy puff pieces and “event coverage” from SiliconANGLE, so it’s marketing disguised as “journalism”


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts