The DeepSeek platform, open source generative AI, continues facing aseries of DDoS attacks, according to the NSFOCUS Global Threat Hunting System, global reference in cybersecurity
Last Friday (31), NSFOCUS detected three waves of DDoS attacks targeting IP address 1.94.179.165. The first, at 15:33:31, January 25, Monday at 13:12:44 (day 26), and another day 27, at 18:09:45 (GMT+8)
According to the cybersecurity company, the average duration of the attacks was 35 minutes, since the criminals primarily targeted DeepSeek through Network Time Protocol (NTP) reflection attacks and memcached reflection attacks
In addition to the DeepSeek API interface, NSFOCUS detected two waves of attacks against the chat system interface of DeepSeek, on January 20 — day when DeepSeek-R1 was released — and another day 25. The average duration of the attacks was one hour, and the main methods included NTP reflection and Simple Service Discovery Protocol reflection. The three main sources of attack infrastructure were the United States (20%), the United Kingdom (17%) and Australia (9%)
According to Raphael Tedesco, business manager of NSFOCUS for Latin America, when the resolution IP address of DeepSeek was changed (on January 28), the attacker "quickly adjusted" their strategy and launched a new round of DDoS attacks on the main domain name, in the API interface and in the chat system, what reflects the high complexity of the tactic used
"From target selection to precise understanding of time and", next, to the flexible control of the attack intensity, the invader shows an extremely high level of professionalism at every stage. The highly coordinated and precise attacks suggest that the incident was not accidental, but rather well planned and organized, executed by a professional team, highlights Tedesco
Received with fervor since its arrival in the market, with first-generation large language models and low cost to train them, the platform continues ahead of ChatGPT, main competitor, in the chart of free apps from the Apple App Store
