Three DDoS attacks, one $200 ransom note — and why we paid Cloudflare instead

June 2019. Somehow these things always happen when I’m away — I was in Italy with my son when Blockchain Cuties came under a DDoS attack. I put the site behind Cloudflare, and we wrote scripts by hand to filter the attackers’ POST requests to the home page. They changed tactics; I brought up about a dozen more servers, going from 8 to 20. After two or three days they realised they weren’t getting anywhere and stopped. My tweet from 12 June: “Blockchain Cuties now is under DDoS attack. But everything is working fine. Thanks Cloudflare!”

September 2019. On the 22nd a letter reached us through customer support. It’s worth quoting, typos included:

We are actually attacking your website blockchaincuties.com that makes it unavailable for everyone online. […] We are aware that you are going to lose more money every hours […]

We ask you to pay us only $200 in Bitcoin to the following address: 1C1YVY…5vbf

Now you are for sure thinking about buying or installing a DDoS Protection Firewall […] a good DDoS Protection Firewall will cost you way more than what we are asking and that you will need a few days to configure it perfectly, think about all the money you are going to loose if you do that. Also, we are using less than 20% of our total power […]

We didn’t pay. The protection they warned us about was already in place.

June 2020. Another wave: traffic jumped from about 200 MB to 160 GB. The new server configuration blocked it.

Bandwidth during the attack, peaking at about 160 GB. From my tweet of 8 June 2020.

They were right about one thing: protection cost more than $200. It still was the better deal.

Why not pay: a ransom buys a pause, not protection — and tells the attacker you’re a customer who pays. Pay once and they come back. Capacity and a filter in front of the site keep working next time.