Hacker focus in election season

9 comments on “Hacker focus in election season”

Comment numbers have changed to permanent references. Older quoted numbers may no longer identify the same comment.

1. 1

   Any attacks from IP addresses in Israel – or might that have been outsourced to 2nd place getter USA??

   Reply
   1. 1.1

      Not in the top 10 countries. Normally the US servers are the top. But it wouldn't surprise me if the US servers are more locked down in the mid-terms.

      Reply
2. 2

   Do you think there might be a connection between those overseas hackers and vested interests in NZ? Or is that taking it too far?

   Reply
   1. 2.1

      Could be out-sourced. The only thing I can see from RIPE is

      netname: VDSINA-NET
      descr: VDSINA VDS Hosting
      org: ORG-HTL17-RIPE
      country: RU
      geofeed: https://vdsina.ru/geofeed.csv
      admin-c: HTL31-RIPE
      tech-c: HTL31-RIPE
      abuse-c: HTL31-RIPE
      status: ASSIGNED PA
      mnt-by: ru-vdsina-1-mnt
      created: 2020-10-15T09:58:49Z
      last-modified: 2026-08-25T09:44:05Z
      source: RIPE

      organisation: ORG-HTL17-RIPE
      org-name: Hosting technology LTD
      country: RU
      reg-nr: 1147746572929
      org-type: LIR
      address: 1-st Frezernaya str. 2/1 korp. 2
      address: 109202
      address: Moscow
      address: RUSSIAN FEDERATION
      phone: +79150111651
      admin-c: AR43838-RIPE
      tech-c: AR43838-RIPE
      abuse-c: AR43838-RIPE
      mnt-ref: ru-vdsina-1-mnt
      mnt-by: RIPE-NCC-HM-MNT
      mnt-by: ru-vdsina-1-mnt
      created: 2017-11-10T09:14:39Z
      last-modified: 2026-08-25T09:44:21Z
      source: RIPE # Filtered

      role: Hosting technology LTD
      address: 1-st Frezernaya str. 2/1 korp. 2
      admin-c: SK10337-RIPE
      tech-c: SK10337-RIPE
      abuse-mailbox: abuse@vdsina.ru
      nic-hdl: HTL31-RIPE
      mnt-by: ru-vdsina-1-mnt
      created: 2018-02-19T16:32:26Z
      last-modified: 2018-02-19T16:32:26Z
      source: RIPE # Filtered

      Reply
3. 3

   How accurate are the detection methods? Can they determine the true location of Fake IP addresses? does AI have any role, just so I can dig AI deeper into the hole I'd like to bury it?

   Reply
   1. 3.1

      The way this particular defence works is that it runs rules on the behaviour of IPs.

      Some of the main rules are

      • If the IPs attempt known wordpress hacks, like xmlrpc – then they immediately get blocked for a couple of hours. Known wordpress.com IPs have an exemption for JetPack usage.
      • If the IPs try PHP hacks like XSS or SQL injection hacks they will get blocked for an hour.
      • If the IPs attempt to read pages too fast then they will get blocked for 30 minutes. Different standards for known bots vs humans. There is a special exemption for the IPs for google bots. If we ever got search traffic from other search bots, then I'd add them as well. But no other search bots usually meet minimum standards.
      • If the IPs have tried and failed to login a number of times they will get blocked for an hour.
      • etc…

      IP spoofing gets handled at a different layer before these ones and doesn't get through. Using VPNs, SSH, etc it just looks at the address. Becomes a problem if someone uses VPN gateways or proxy servers and others.

      I also have some software defences against related IPs for server farms.

      The worst ones are the hacker botnets of coopted machines. But they usually won't show up on these measures because they try the same attacks over a wide range of IPs and typically only a few operations per IP. They often get caught in DDOS traps that are external to my systems.

      Reply
4. 4

   In election season, this site gets a certain amount of hacker attention. It drives the usual attempts by hackers wanting to add my systems to their bot nets, AI scanners, and search bots into the background. This year it appears to be somewhat one sided. This year the Russian Federation are interested. Almost obsessed.

   What is the point of them doing that?

   Reply
   1. 4.1

      What is the point of them doing that?

      Seymour is a Russian plant and they're trying to get him elected, !!

      That is joke btw ,,,or isss it??

      Reply
   2. 4.2

      They usually want to access the server to inject misinformation via comments – those are the BusyBee attempts. Or posts/comments by cracking valid logins to do that, or to write posts – see the login attempts. Or they try the same thing with various ways of various technical means – mostly xmlrpc, XSS, or a number of other techniques.

      Some just want to turn the server into a botnet slave to distribute messages by various means to other systems, or to provide a way of launching attacks on other systems.

      What is interesting about this lot is that it is mostly coming from a single organisation and geographical location for some unknown reason. Normally I have a wide selection countries and organisations doing bad behaviour – Turkey, Netherlands, Iran, Singapore, Bulgaria, and the always ubiquitous US in part. But for the last couple of weeks it has changed to mostly one organisation and one country at a much higher level.

      Gemini describes VDSINA and malicious behaviour as:-

      Here is a breakdown of why VDSINA is often linked to malicious behavior:

      1. Frequent Abuse by Bad Actors

      Cybersecurity vendors (such as Malwarebytes) have repeatedly flagged domains and subdomains hosted by VDSINA. The infrastructure has been observed hosting riskware, potentially unwanted programs (PUPs), adware, and phishing sites. This is not unique to VDSINA; bad actors heavily favor budget VPS hosts globally because they offer rapid deployment, low costs, and high anonymity. [1, 2]

      2. High-Anonymity and Low Barriers to Entry

      VDSINA allows users to rent high-speed infrastructure (such as AMD EPYC servers with up to 10 Gbps internet ports) for a few dollars or rubles a day. They also allow custom ISO uploads, allowing anyone to install unverified operating systems or software. For bad actors launching scalable malware or phishing campaigns, this provides a cheap, disposable launchpad. [1, 2, 3, 4, 5]

      3. Geopolitical Risk and Sanctions Checks

      On community forums like Reddit, users noted that VDSINA has faced disruptions in European data centers due to regulatory checks and alleged sanction evasion concerns surrounding their partner networks. Because the company handles substantial traffic out of Russia while serving global clients, it faces higher regulatory scrutiny from Western cybersecurity firms and internet exchanges. [1, 2]

      Summary

      VDSINA itself is a standard tech utility company. However, their low prices, automated setup, and data center locations make them a frequent target for exploitation by automated malicious bots, phishers, and adware distributors. If you have encountered a malicious URL hosted by them, you can report it directly to their threat desk at abuse@vdsina.ru. [1, 2, 3, 4, 5]

      I never know the point about why botnets get interested in this site. But we always get a pretty massive spike in traffic around election time. But it is usually less concentrated than this by source, and doesn't usually involve as many blocks – which is by definition bad behaviour and active hacking. That is why I describe it as inept.

      The high level of reads from China is unusual because it is not blocked. It is just a lot of reading from a dispersed set of IPs running slower pickups. Probability is that it is some kind of data mining for AI programs.

      Reply