Jérôme Meyer<p>About this X DDoS campaign: I've seen reports of attribution to Ukraine, and at least based on attack data at network level — I just don't see it. (And I should note: attribution is hard, so I am generally skeptical.)</p><p>Top contributors are 🇺🇸🇲🇽🇪🇸🇮🇹🇧🇷, and as with most botnets: very geographically distributed.</p><p>Most of the source IPs intersect with <a href="https://infosec.exchange/tags/Eleven11bot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Eleven11bot</span></a> as we started seeing them on 26 February.</p><p>OK, now back to regularly scheduled skiing.</p><p><a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>threatintel</span></a></p>