Uncensored.si - Bots and devices from 40 countries: this is how they wanted to bring down Uncensored.si

On August 12, 2026, the website necenzurirano.si became the target of a large-scale organized cyberattack that disrupted access to its content for users in multiple countries. The attack began late Saturday at 6:30 PM local time, initially blocking access to the site from several foreign nations. By Sunday morning, numerous users reported being unable to reach the website even within Slovenia. As the situation escalated, additional protective measures were implemented to mitigate the impact of the attack, which continued into Monday. On Monday, the site published photographs of a new prestigious vehicle owned by the Slovenian politician Boris Mijič, followed by further attacks later that day. The attack was identified as a Distributed Denial of Service (DDoS) assault, a type of malicious attempt to prevent a targeted server, network, or website from functioning properly by overwhelming it with a flood of traffic. The attackers aimed to disrupt the availability of content on necenzurirano.si, potentially preventing the publication of articles or other materials. While the exact origin of the attack remains unclear, evidence suggests that the perpetrators had previously infected thousands of devices, computers and other vulnerable systems, in 40 different countries around the world. These compromised devices were then instructed to simultaneously request access to the website and other Slovenian media outlets. According to reports, the attack reached its peak during the night of Sunday, when the network infrastructure was overwhelmed by an unprecedented volume of data packets. This surge in traffic caused the website’s server to slow down significantly, eventually leading to temporary unavailability. Users attempting to visit the site encountered an error message indicating HTTP 503 (Service Unavailable), which typically occurs when a server is temporarily overburdened or undergoing maintenance. Over the course of 24 hours, from Monday to Tuesday, the website received more than 11 million requests from the United States, Indonesia, Germany, Netherlands, and Singapore alone, equivalent to five times the usual traffic volume in one month. The attack originated from a geographically dispersed network of compromised devices, with IP addresses traced back to approximately 40 countries. Analysis indicates that the majority of these infected IP addresses launched attacks against the site fewer than ten times on average. This pattern suggests the involvement of botnets, networks of hijacked computers used to launch coordinated attacks. Such methods often involve intermediaries, such as proxy servers, which obscure the true identity of the attacker. As a result, identifying the actual perpetrator remains highly unlikely, as the financial transactions associated with such attacks are frequently conducted using cryptocurrency. The incident was reported to the national cybersecurity response center, SI-CERT. A spokesperson for the organization emphasized that while the attackers remain anonymous, their actions will not deter the continued operation of the platform. Primož Cirman, a representative of the affected website, stated, “Anonymity does not protect them. Our operations will continue.” Similarly, Sašo Švigelj, another key figure, described the attack as targeting not just the website itself, but also its audience and the broader community of readers who rely on the information it provides. He added, “This was an attack on our work, on our media, and on all people who support us.”