The DeepSeek platform, an open-source generative AI, continues to face a series of DDoS attacks, according to the NSFOCUS Global Threat Hunting System, a global reference in cybersecurity.
Last Friday (31), NSFOCUS detected three waves of DDoS attacks targeting IP address 1.94.179.165. The first occurred at 15:33:31 on January 25, the second at 13:12:44 (January 26), and another on the 27th at 18:09:45 (GMT+8).
According to the cybersecurity company, the average duration of the attacks was 35 minutes, with criminals primarily targeting DeepSeek through Network Time Protocol (NTP) reflection attacks and memcached reflection attacks.
In addition to the DeepSeek API interface, NSFOCUS detected two waves of attacks against the DeepSeek chat system interface on January 20—the day DeepSeek-R1 was launched—and another on January 25. The average attack duration was one hour, with the main methods including NTP reflection and Simple Service Discovery Protocol reflection. The top three sources of attack infrastructure were the United States (20%), the United Kingdom (17%), and Australia (9%).
According to Raphael Tedesco, NSFOCUS Business Manager for Latin America, when the DeepSeek resolution IP address was changed (on January 28), the attacker ‘quickly adjusted’ their strategy and launched a new round of DDoS attacks on the primary domain name, the API interface, and the chat system, reflecting the high complexity of the tactic used.
‘From target selection to precise timing and then flexible control over attack intensity, the attacker demonstrates extremely high professionalism at every stage. The highly coordinated and precise attacks suggest the incident was not accidental but well-planned and organized, carried out by a professional team,’ Tedesco emphasizes.
Received with fervor since its market debut, with cost-effective first-gen large language models, the platform continues to lead ChatGPT, its main competitor, on the Apple App Store’s free apps chart.
