Russian Homosexual Sites Under (Commissioned) DDoS Attack

From Russia with homophobia?

A week long DDoS attack launched against Russia's most popular commercial homosexual sites has finally ended. The simultaneous attack managed to successfully shut down the web servers of most of the sites, which responded with filtering of all traffic that is not coming from Russia. Ironically, the attack was in fact coming from Russian, courtesy from a botnet operated by a DDoS for hire service.

Here's a list of the sites that were subject to the DDoS, with the majority of them returning "503 Service Temporarily Unavailable" error message during last week :
gogay.ru
1gay.ru
androgin.ru
boysclub.ru
egay.ru
gaylines.ru
gaymoney.ru
gayplanet.ru
gayrelax.ru
xabalka.ru

On the 25th of January, gogay.ru was among the few sites to issue a statement and confirm the attacks offering financial reward for information leading to the source :

"Yesterday (25 February), our site is subjected to serious hacker attacks (flood-attack capacity of 2 Mbit / sec). The attack reflected, but is still continuing at other gay sites 1gay.ru, egay.ru, xabalka.ru and so on. If you have any information (we are willing to pay for инфу of tailor-made) on the causes of the attack, if you - the webmaster and your own gay website exposed attacks (if the last few days your site has been slow to load and create a greater burden - it is very likely that the same attack, only disguised), sabotage, blackmail or extortion by unidentified persons - always contact us."

Since the sites are commercial providers of homosexual multimedia content and are thereby bandwidth-consuming, the attacks were aiming to disrupt their business operations, and they managed to do so. Russia's government is well known to have a rather violent take on homosexuality in general, and with overall availability of outsourced DDoS attack services offering anonymity and destructive bandwidth, the efforts to request such an attack remain minimal.

Summarizing Zero Day's Posts for February

The following is a brief summary of all of my posts at ZDNet's Zero Day for February. You can also go through previous summaries for January, December, November, October, September, August and July, as well as subscribe to my personal RSS feed or Zero Day's main feed.

01. Commercial Twitter spamming tool hits the market
02. Fake Antivirus XP pops-up at Cleveland.com
03. Report: 92% of critical Microsoft vulnerabilities mitigated by Least Privilege accounts
04. Massive comment spam attack on Digg.com leads to malware
05. Crimeware tracking service hit by a DDoS attack
06. Targeted malware attacks exploiting IE7 flaw detected
07. New Symbian-based mobile worm circulating in the wild
08. Rogue security software spoofs ZDNet Reviews
09. Adobe Reader 9 and Acrobat 9 zero day exploited in the wild
10. Chinese hackers deface the Russian Consulate in Shanghai
11. eBay solutions provider Auctiva.com infected with malware
12. Malware campaign at YouTube uses social engineering tricks
13. Research: 76% of phishing sites hosted on compromised web servers