X users aren’t buying Musk’s claim Ukraine was behind site’s massive outage

Users on X are having a hard time believing Elon Musk’s claim that Ukraine was behind the site's massive outage yesterday. 

Following lengthy outages on Monday that left thousands of users without access, Musk claimed the site experienced a “massive cyberattack.”

“There was (still is) a massive cyberattack against X,” he wrote. “We get attacked every day, but this was done with a lot of resources. Either a large, coordinated group and/or a country is involved. Tracing …”

Despite the hacking collective Dark Storm Team taking credit for the attack, Musk is pointing towards Ukraine as the culprit. 

On Monday, Musk told Fox Business Network that the attackers “had IP addresses originating in the Ukraine area” without explaining what that might mean. 

This vague link to Ukraine triggered vitriol online. 

Responding to the attack, some of Musk’s backers called the country ungrateful for Musk’s support, particularly because to its use of Starlink technologies. 

"Ukraine is so ungrateful for Starlink that has given them the opportunity needed in the war or they wouldn’t have stood a chance," wrote a reply.

“Remember when Zelensky was in the Oval Office and threatened America?” one X user wrote, “Well it looks like he wasn’t kidding. Elon says today’s cyberattack on X originated from Ukraine.”

Others think Musk’s claims are just a bit too coincidental, particularly following the fiery press conference last week among Ukrainian President Volodymyr Zelensky, President Donald Trump, and Vice President JD Vance. 

However, amid the anger, others are readily debunking Musk’s claims. 

The cyberattack, which has been identified by experts as a distributed denial-of-service (DDoS) attack, likely came through several diverse IP addresses across the world, not just within Ukraine.  

DDoS attacks are often launched through a coordinated army of computers or a “botnet” striking a target with junk traffic to overwhelm its systems. Botnets generate traffic from diverse IP addresses from across the world. They also include mechanisms that make it harder to determine who is controlling them. 

Speaking to the AP, Allan Liska of the cybersecurity firm Recorded Future, pointed out that even if “every IP address that hit Twitter today originated from Ukraine (doubtful), they were most likely compromised machines controlled by a botnet run by a third party that could be located anywhere in the world.”

Debunking Musk’s claims, users tried to explain the slipperiness of determining the geographical origins of DDoS attacks. 

On posts that shared Musk blaming Ukraine, readers have added a community note challenging the Ukraine claims with news coverage of Dark Storm Team taking responsibility. 

Users also called out the odd logic of making your IP address publicly known when completing a cyberattack. 

“Musk thinks people are stupid,” another user responded.

Internet culture is chaotic—but we’ll break it down for you in one daily email. Sign up for the Daily Dot’s web_crawlr newsletter here. You’ll get the best (and worst) of the internet straight into your inbox.