11 June 2025
On May 21, the Peruvian investigative outlet IDL Reporteros was targeted by a Layer 7 DDoS attack involving over 10,000 unique IP addresses. Four days later, Armando.info, a Venezuelan investigative media platform, faced a 48-hour long series of denial-of-service attacks. On May 21, the Peruvian investigative outlet IDL Reporteros was targeted by a Layer 7 DDoS attack involving over 10,000 unique IP addresses. Four days later, Armando.info, a Venezuelan investigative media platform, faced a 48-hour long series of denial-of-service attacks. These attacks employed multiple vectors, making them difficult to fingerprint and mitigate.
What both IDL Reporteros and Armando.info have in common is their role in exposing corruption, financial fraud, and abuse of power within their respective governments.
The origin of the denial-of-service attacks was traced back to yet another proxy service provider lacking adequate controls to prevent misuse by malicious actors.
The infrastructure used in the attacks was traced to Peg Tech Inc., a California-based hosting provider with Chinese ownership. While the attack was carried out by a client of Peg Tech, the company declined to disclose the customer’s identity, citing privacy concerns. Instead, it responded by merely blackholing the offending IP address.
This inadequate abuse response enables attackers to easily register new accounts and resume launching DDoS attacks the same day. Moreover, Peg Tech’s lax abuse policies allow proxy operators to control large IP ranges with minimal oversight, effectively shielding potentially malicious actors from accountability and external scrutiny.
Concerns surrounding Peg Tech Inc. extend beyond its inadequate abuse policies. The company exhibits a lack of ownership transparency, and all communications with its staff have been conducted through generic email addresses, with no names or job titles provided. Despite being registered in the United States, Peg Tech controls a vast IP address space, including at least 100,000 IP addresses that appear to have been improperly acquired from AFRINIC, the Regional Internet Registry (RIR) responsible for managing IP resources across the African continent.
Forensic report: Denial-of-Service Attacks on Investigative Media Traced to yet another Proxy Provider
Contacts
Digital forensics: Tord Lundström <t at virtualroad.org> Technical Director
Media: Clara Zid <info at virtualroad.org> Media and Outreach Manager