Valentine’s Day DDoS: The “Gift” That Tried to Take digi77.com Down

February 14, 2026 — Battle-Tested Defense Against Subnet-Rotating Botnets

# Multi-vector threat detection engine
# Monitors 5+ attack signals simultaneously:
#
#   → CPU load average (detects resource exhaustion)
#   → SYN-RECV flood count (half-open connection attacks)
#   → ESTABLISHED connection saturation
#   → UDP amplification indicators
#   → Connection rate acceleration
#
# When ANY signal exceeds its adaptive threshold,
# the script shifts into aggressive mitigation mode.
#
# Thresholds auto-adjust based on server capacity
# and current baseline — not static values.

check_system_threat() {
    # [5 independent detection vectors evaluated here]
    # Each vector has its own adaptive threshold logic
    # Returns threat level: CLEAR / ELEVATED / CRITICAL
    ...
}

# Real-time offender ranking engine
# Correlates MULTIPLE data sources to identify attackers:
#
#   → Active connection concentration (per-IP)
#   → Half-open connection patterns (SYN flood signature)
#   → Request rate vs. baseline deviation
#   → Subnet clustering (are IPs from the same /24?)
#   → Hosting provider vs. residential classification
#
# Output: ranked list of offenders with confidence scores
# Top offenders are processed for blocking decisions

rank_offenders() {
    # [Multi-source correlation engine]
    # Not just "who has the most connections"
    # but "who deviates most from normal behavior"
    ...
}

# Intelligent false-positive prevention
#
# The script maintains a classification engine that
# distinguishes between:
#
#   ✓ Legitimate VPN providers (20+ services recognized)
#   ✓ Known CDN and cloud infrastructure
#   ✓ Residential ISPs with normal traffic patterns
#   ✗ Hosting providers being used as botnet sources
#   ✗ Subnets with abnormal connection density
#
# Blocking decisions use DYNAMIC thresholds —
# not a single hardcoded number, but adaptive logic
# that considers the source type, connection pattern,
# and current attack intensity.

classify_and_decide() {
    # [Classification + adaptive threshold engine]
    ...
}

# Behavioral escalation system
#
# All blocks start as TEMPORARY (configurable duration).
# The system tracks every blocked source and builds
# a behavioral profile over time:
#
#   Stage 1: Temp block → auto-expires
#   Stage 2: Repeat detection → longer duration
#   Stage 3: Persistent offender → permanent + CSF deny
#
# Each stage includes:
#   → Country and provider enrichment
#   → Attack pattern classification
#   → Subnet correlation analysis
#   → Timestamp-based repeat window tracking
#
# This prevents permanent blocking of one-time scanners
# while ensuring real attackers can't just wait it out.

escalation_engine() {
    # [Multi-stage behavioral tracking system]
    # Tracks history, enriches with GeoIP, escalates
    # based on repeat frequency within time windows
    ...
}

# Attack intelligence and GeoIP enrichment
#
# Every blocked source is enriched with:
#   → Country of origin
#   → Hosting provider / ISP name
#   → VPN/proxy/datacenter classification
#   → Historical offense count
#
# Enrichment runs in parallel batches for speed
# (doesn't slow down blocking during active attacks).
#
# Intelligence output reveals:
#   → Which countries the attack originates from
#   → Which hosting providers are most abused
#   → How the attacker rotates across regions
#   → Burst timing and wave patterns

# Real output from this incident (Feb 14, 2026):
# ┌──────────────────┬───────┬────────┬────────┐
#  │ Country          │ Hits  │   IPs  │ % Hits │
# ├──────────────────┼───────┼────────┼────────┤
# │ France           │ 495x  │   176  │ 45.9%  │
# │ Germany          │ 164x  │    64  │ 15.2%  │
# │ USA              │ 120x  │    85  │ 11.1%  │
# │ Russia           │  22x  │    12  │  2.0%  │
# │ Singapore        │  21x  │    21  │  1.9%  │
# │ Netherlands      │  14x  │     8  │  1.2%  │
# │ Poland           │  13x  │     9  │  1.2%  │
# │ Switzerland      │  13x  │     8  │  1.2%  │
# │ Japan            │  13x  │     8  │  1.2%  │
# │ United Kingdom   │  13x  │     4  │  1.2%  │
# └──────────────────┴───────┴────────┴────────┘

Escalation stats: 60.6% of entries are still temporary (below 3x threshold) — 39.3% were promoted to permanent blocks after repeated offenses. GeoIP enrichment resolved 480 of 495 entries across 47 countries and 134 providers.

# Quick status check
./ddos-detect.sh --status

# Full diagnostic scan with all attack vectors
./ddos-detect.sh --diagnose

# Continuous monitoring (refresh every N seconds)
./ddos-detect.sh --watch 5

# Watch mode with auto-ban and logging
./ddos-detect.sh --watch 10 --ban --log /var/log/ddos-detect.log

# JSON output for monitoring integration (Netdata/Prometheus)
./ddos-detect.sh --json

# Auto-ban attackers exceeding threshold
./ddos-detect.sh --ban --threshold 100

# List currently banned IPs
./ddos-detect.sh --list-bans

# Unban specific IP
./ddos-detect.sh --unban 1.2.3.4

# Preview CSF blocks without applying (dry-run)
./ddos-detect.sh --apply-csf --dry-run

# Auto-apply all CSF blocks (temp first, permanent after 3x repeat)
./ddos-detect.sh --apply-csf

# Apply with longer temp ban duration (default 3600s = 1 hour)
./ddos-detect.sh --apply-csf --duration 86400

# Show repeat offender tracking data (temp vs permanent stats)
./ddos-detect.sh --show-offenders

# Enrich missing entries with country/provider data
./ddos-detect.sh --enrich-offenders

# Re-enrich ALL entries from scratch (full rebuild)
./ddos-detect.sh --rebuild-offenders

# Install cron (every 15 min, auto-blocks when under attack)
./ddos-detect.sh --install-cron

# Custom: every 5 min, load threshold 8
./ddos-detect.sh --install-cron --cron-interval 5 --load-threshold 8

# Remove cron
./ddos-detect.sh --remove-cron

# Check all dependencies and offer to install missing ones
./ddos-detect.sh --check-deps

Important reality check:

If your uplink is fully saturated upstream, local tools can’t beat physics — provider-level filtering is often required.

But if the attack is designed to melt your server resources using valid traffic (CPU/conntrack/workers), local mitigation can keep you alive — and it did.

Get the Script (Support Kodachi)

I’ve released plenty of free scripts and sources before — 100+ over time. This one is different: it’s battle-tested under a real attack, and it’s not something you’ll easily find “ready-made” on the net.

If you want it, support the Kodachi project with a $30 donation and I’ll send you the complete solution as a thank-you — 4,000+ lines of battle-tested code.