Found the correct thread for this.
Musk saying that DDoS traffic was coming from Ukraine, blaming them for the attacks on Twitter.
A few hours after the final attack concluded, Musk told Fox Business host Larry Kudlow in an interview, “We're not sure exactly what happened, but there was a massive cyberattack to try to bring down the X system with IP addresses originating in the Ukraine area.”
Except a: In short, that's not really how DDoS works - it stands for '
distributed denial of service' the point being to have traffic come from all over the place, so having it all come from one country would be remarkably fucking stupid.
You can literally go into Cloudflare, and block almost the entirety of that country (based on geographical metadata for the IP ranges, which is reasonably accurate - accurate enough for these purposes at least). So if it were all coming from Ukraine, it would have been nixed in five minutes flat, ezclap, attack over.
Block the majority of ukranian networks and boom, attack mitigated almost immediately - and you can then perform more analysis to drill down to block individual ASNs, ISPs, subnets etc so that you can be less scattergun with your approach - but for the rest of the world, your service is still available.
If you're being attacked in a DDoS with traffic from just one country, that's proper amateur hour stuff and shouldn't take your site down if you have even basic Cloudflare-level protection, especially at the scale Twitter is.
Naturally, the DDoS didn't all come from Ukraine, and Musk is just flat out lying because as a useful idiot - he's not smart enough to be actually on Russian payroll - he's been told to blame Ukraine for anything he can. Of course there'd be IPs originating from Ukraine, because people in Ukraine use internet enabled camera systems and routers that get hacked and used in botnets. It's such a
pathetic play.
Of course, it helps if you have your infrastructure, you know,
actually behind cloudflare...
DDoS attacks are common, and virtually all modern internet services experience them regularly and must proactively defend themselves. As Musk himself put it on Monday, “We get attacked every day.” Why, then, did these DDoS attacks cause outages for X? Musk said it was because “this was done with a lot of resources,” but independent security researcher Kevin Beaumont and other analysts see evidence that some X origin servers, which respond to web requests, weren't properly secured behind the company's Cloudflare DDoS protection and were publicly visible. As a result, attackers could target them directly. X has since secured the servers.
“The botnet was directly attacking the IP and a bunch more on that X subnet yesterday. It's a botnet of cameras and DVRs,” Beaumont says.
....
DDoS traffic analysis can break down the firehose of junk traffic in different ways, including by listing the countries that had the most IP addresses involved in an attack. But one researcher from a prominent firm, who requested anonymity because they are not authorized to speak about X, noted that they did not even see Ukraine in the breakdown of the top 20 IP address origins involved in the X attacks.
If Ukrainian IP addresses did contribute to the attacks, though, numerous researchers say that the fact alone is not noteworthy.
“What we can conclude from the IP data is the geographic distribution of traffic sources, which may provide insights into botnet composition or infrastructure used,” Zayo’s Edwards says. “What we can’t conclude with certainty is the actual perpetrator’s identity or intent.”
And that's what happens when you sack the staff who are in charge of change control and detailed systems management because they don't write extreme code, and are just 'seat warmers' who aren't prepared to work 80 hours a week for a laminate faced fuckwit with all the inherent charm of bowel cancer.
They got crippled by an attack that I've yet to see be described as notably large by anyone in the cybersecurity world via their own monitoring (only Musk is claiming this), because Twitters systems are likely poorly managed and as a result flaky as fuck (because he sacked the sort of people who would give devops engineers slaps on the wrist for not putting infrastructure in the correct security groups)
https://www.wired.com/story/x-ddos-attack-march-2025/
Even the former head of the NCSC has said that Musks explanation of events was
"wholly unconvincing" and
"pretty much garbage."
https://www.bbc.co.uk/news/articles/c62x5k44rl0o
So my suggestion in one of the other threads that it was a coin flip as to whether it was a real attack or their infrastructure being shit seems to have landed on it's edge. Common attack, shitty infrastructure management.
