Hacker News Reader

So you DDOSed their backend but they could've whitelist their IP range and blacklist all the others for incoming requests.

What you did does nothing against flexible and adaptive adversaries.

View on HN

People who buy phishing kit and set them up are typically not flexible and adaptive adversaries.

Even if that's the case, it made the website unavailable for future victims who got the same text messages.

Not if they just made the site return a 404/500 just to his IPs, which any half-decent adversary would do. The "play dead" strategy works great with these kind of vigilantes.

We're employed similar tactics against DDoSers at work. Start returning 500s or just tarpit their requests, they think the site is down and they go home.

Reply on news.ycombinator.com