Postmortem DDoS Attack of May 28th, 2026

  • Want to keep track of this thread?
    Accounts can bookmark posts, watch threads for updates, and jump back to where you stopped reading.
    Create account
In case you're wondering, it's a transgender kid taking credit. I'm not giving him any attention. He says he's doing it because he's angry about transgender injustice.
Is there gonna be a debrief on the attack? I'm honestly interested in the statistics, unless there's nothing new to say or stuff you'd rather withhold.
 
Null should eventually write about his experiences keeping the site up and running over the years. It'd be an interesting analysis on just how resilient a single person can be even when the odds are basically rigged against them.
 
These troons seem to have way too much time on their hands. Don't they have some dilating to do?

tenor(4).gif
 
Null should eventually write about his experiences keeping the site up and running over the years. It'd be an interesting analysis on just how resilient a single person can be even when the odds are basically rigged against them.
Agree but I raise you one: Null needs to package and sell his knowledge to others so they can do the same. hes seems like the only man alive right now capable of making an independent website on the clearnet
 
Too bad you can't just drag his ass before court as DDOS'ing isn't exactly a heroic act but a criminal act that can be punished severly
 
These troons seem to have way too much time on their hands. Don't they have some dilating to do?

View attachment 9074755
Lol no, they usually stop that pretty quick because it's painful and their sex drive gets dumpstered after castration. They think it might come back once they cut off their dick and have a stink ditch to fuck; it doesn't.
 
Its one thing to take credit, its another to actually do it. Who knows where its really coming from. Still, probably a tranny of some sort. Disgusting creatures...
nah dawgg Donny T felt personally threatened that Null was going to open the celebrity retard board so he took the combined glownigger might of the FBI, CIA and NSA to attack the site.
And we're still here
 
Is there gonna be a debrief on the attack? I'm honestly interested in the statistics, unless there's nothing new to say or stuff you'd rather withhold.

In case you're wondering, it's a transgender kid taking credit. I'm not giving him any attention. He says he's doing it because he's angry about transgender injustice.
He says it's his own botnet and that he's assembled it in the name of trans rights. If that's true, it's free (except for the taxpayer dollars he receives).

In addition to the attribution above, null talked about things on MatI yesterday:

Here is a screengrab of the explanation and final solution:
1780158730229.png
(The cropping was from the video.)

Below is a LLM summary from the clip:

Context​

This is a livestream segment by Null, the founder and administrator of Kiwi Farms, discussing a significant DDoS attack that recently affected the site. The discussion serves both as a technical postmortem and a fundraising/business discussion about the site's future infrastructure.

What Happened​

  • Null explains that Kiwi Farms experienced a major DDoS attack that disrupted most of its public-facing infrastructure.
  • He says the site ultimately remained accessible primarily through its Tor onion service after conventional access paths were overwhelmed.
  • According to Null, the attack ceased because the attacker stopped rather than because Kiwi Farms successfully defeated it.

Technical Explanation​

  • Null walks viewers through Kiwi Farms' hosting architecture, which uses multiple providers and geographically distributed servers.
  • He argues that the design intentionally limits trust between systems so that compromise of a front-end node would not expose the core site.
  • During the attack:
    • Smaller servers and VPS instances reportedly became overloaded.
    • Traffic shifted toward the remaining servers.
    • One larger server handled most of the remaining traffic until the provider blackholed it to protect its network.
    • Null cites a reported peak of roughly 165 Gbps of attack traffic.

Criticism of Providers​

  • Null criticizes several infrastructure and DDoS-protection providers.
  • He expresses frustration with providers he believes offer inadequate protection or have policies that prevent Kiwi Farms from using their services.
  • He also accuses specific individuals associated with parts of the industry of misconduct and claims this has affected Kiwi Farms' ability to obtain protection services.

Proposed Solution: "Kiwi Flare"​

  • A major theme of the stream is Null's proposal to build an independent DDoS-mitigation network, jokingly referred to as "Kiwi Flare" (a reference to Cloudflare).
  • The idea would be to create infrastructure capable of filtering attacks without relying on third-party providers that might refuse service or prove unreliable.
  • He presents rough estimates for bandwidth, hardware, networking equipment, and data-center costs.

Funding Discussion​

  • Null estimates that operating such a system could cost roughly $10,000–$15,000 per month, potentially much more if attacks grow larger.
  • He discusses several ways to finance it:
    • Donations from supporters.
    • Selling DDoS-mitigation services.
    • Running a VPN service.
    • Merchandise or other side businesses.
    • Partnerships with technically skilled collaborators.

Audience Appeal​

  • The latter portion functions partly as a recruitment and fundraising pitch.
  • Null invites people with networking, infrastructure, and security expertise to contact him if they are interested in helping develop the proposed mitigation service.

Main Takeaway​

Viewed in context, the transcript is less a neutral explanation of a cyberattack and more a strategic update from Kiwi Farms' owner. Null uses the attack as evidence for why he believes the site needs greater infrastructure independence and then explores the technical, financial, and organizational challenges of building a self-operated DDoS-mitigation network.
I would just note the summary isn't perfect - for one, Tartarus is in place and working better and better.

Edit to add: Null has also been posting to tg, which I don't know all of those have been screencapped:
1780174256337.png
1780174278674.png
1780174299776.png

Text of the telegrams (all times EDT):
  • May 27
    • DDoS attack. Blame it on your boogeyman of choice. I personally blame the anti-Harambe crowd. Those scum.
      23:03
  • May 28
    • I believe I have patched the attack vector. The new Tartarus version is rolling out. I'll see if it holds up.
      00:03
    • The site is currently available by Tor. I've been working on it this morning but I am going to need to do more attack fine-tuning tomorrow. Sorry.
      04:01
    • The attack is very large. The providers we have either can't deal with it, or my server with them is too small to deal with what gets through. I'm contacting them to see what can be done, if anything. I am also contacting two new providers I am familiar with to see if they can help expand our umbrella. All of our DDoS filters are European so I have to defer until the morning.
      If that doesn't work, the next step is a literal build-your-own Cloudflare. The world is DDoS filtering as a service is very small an there aren't may options. The cost of entry is very expensive. If you're in that industry or adjacent and have thoughts about making it successful, or if you'd be interested in such a service, or something like a VPN service (which can sell excess bandwidth to help be profitable), email josh@kiwifarms.net .
      We're still up on Tor.
      Sorry there's not more good news.
      21:25
  • May 30
    • The site seems up and stable. If you're having connection issues please email me.
      09:52
    • Transgender members of ANTIFA are taking credit and I consider that the most credible threat actor.
      14:45
My commentary: Assuming the lunatic is honest, end all tugboats. Or if this has become trivial (rather than non-trivial) due to vibe coding... we're in for a world of hurt. Not just The Farms, but the wider Internet.
Additional commentary after tg updates: I'm so glad my tax dollars are still going to fund ANTIFA, and probably "gender-affirming healthcare".
 
Last edited:
Back
Top Bottom