aramido Penetration Testing Offer Victim of a DDoS Attack?

Unexplained Traffic Spikes

A website like aramido.de, which focuses on a specialized topic primarily for corporate customers, normally attracts fewer visitors than large news portals or e-commerce shops. On July 1, 2016, at 6:35 PM, this was different. Suddenly, access to our website increased manifold. Visitors seemed particularly interested in our penetration testing offer .

Is a DDoS Attack Occurring on aramido?

This pattern is typical for an overload attack on web services, causing a so-called Denial of Service (DoS). In this process, a large number of requests are made to the web server within a short period, which is overwhelmed by the overload and blocks further requests from legitimate visitors. Attackers often use specially designed requests that cost the web server particularly high computational capacity. These attacks are frequent just before Christmas, when many web shops generate their highest turnover. The attackers then demand payments from the shop operators in a form of protection racket to reduce the attacks.

But back to our case. The calls all came from different computers, which would be the classic pattern of a so-called distributed (D)DoS attack. Research into the cause of the rapid increase in page views led us to Google as the traffic source. Google Trends shows that on July 1, more people had searched for the term penetration test than ever before in the last ten years.

Why are so many people interested in penetration tests?

The increase in visitors to our website therefore does not seem to be a targeted attack, but was triggered by legitimate requests from many people interested in penetration tests. In finding out where this interest comes from, the "Related search queries" section of Google Trends helps us. There, reference is made to the term Lüster and Orient. If you search Google for this topic, the first result is the website of the ARD quiz show Wer weiß denn sowas?. And indeed, on July 1 at 6:35 PM, the show asked: "Where is a penetration test used?". According to our estimates, more than 10,000 people searched for the term penetration test on Google within a few minutes, who then landed on the penetration test pages of aramido.

Conclusion

The case shows how difficult it is to distinguish and deflect DDoS attacks from legitimate page visits. While technical measures for defense can be taken in the case of DoS attacks, it often helps only to scale the IT infrastructure accordingly at the right moment in the case of DDoS attacks. Trust our expertise in the correct configuration of your web applications and servers, the implementation of an Intrusion Prevention System (IPS), and the choice of the most effective scaling strategy. We look forward to your contact .