Case deepseek-ddos-registration-haltLLMjackingChina
DeepSeek halts new sign-ups after month-long DDoS and brute-force campaign peaks
DeepSeek said its services were under large-scale malicious attack on 28 January 2025 and limited sign-ups to Chinese mobile numbers; Qi An Xin XLab traced a month of escalating DDoS and brute-force traffic.
HighAttack on AIStatus: ResolvedVerified case file
Open in the interactive mapCite this case
- Reported
- Jan 28, 2025
- Location
- China
- Target
- DeepSeek chat and API services
- Severity
- High
- Triggered by
- Unknown
- Actor type
- Unknown
- Reported loss
- None reported
- CVE
- None
What happened
DeepSeek said its services were under large-scale malicious attack on 28 January 2025 and limited sign-ups to Chinese mobile numbers; Qi An Xin XLab traced a month of escalating DDoS and brute-force traffic.
Impact: Hours of outages and degraded API performance for users worldwide; new registrations blocked for non-Chinese phone numbers; existing users could still log in.
Who triggered it
Actor: Unknown
Attribution: Qi An Xin XLab said attack and brute-force IPs were located in the United States; no group was named and DeepSeek did not attribute the attack.
Motive: Unknown; analysts suggested disruption of the newly popular R1 service.
How it happened
Attack vector: Three phases: HTTP proxy floods from 3 January, SSDP and NTP reflection amplification from 20 January, then application-layer HTTP proxy attacks and password brute-forcing peaking 27 to 28 January.
Root cause: Sudden global demand for DeepSeek R1 outpaced the startup's DDoS mitigation and account-protection capacity.
Timeline
- XLab observes first suspected HTTP proxy attacks against DeepSeek
- Application-layer attacks surge; DeepSeek reports degraded web and API performance
- DeepSeek status page cites large-scale malicious attack and restricts registration to +86 numbers
- The Paper publishes Qi An Xin XLab analysis of the three attack phases
Response
DeepSeek switched IP addresses at 00:58 on 28 January, restricted sign-ups and restored service in stages; no user-data theft was confirmed.
Current status: Resolved
Sources (open in a new tab)
- The Paper (澎湃新闻) thepaper.cn
- BleepingComputer bleepingcomputer.com
- GIGAZINE gigazine.net
Cite this case
DeepSeek halts new sign-ups after month-long DDoS and brute-force campaign peaks. AI Threat Watch, case deepseek-ddos-registration-halt, Jan 28, 2025. https://aithreat.io/cases/deepseek-ddos-registration-halt/
Permanent link: https://aithreat.io/cases/deepseek-ddos-registration-halt/