When spammers go to war: Behind the Spamhaus DDoS
Sven Olaf Kamphuis waving the Pirate Party flag in front of CyberBunker's nuclear bunker. — Sven Olaf Kamphuis — Over the last ten days, a series of massive denial-of-service attacks has been aimed at Spamhaus …
Context & Ripple Effects
The fight is a decade in the making: back in 2006 Spamhaus published a blacklist singling out the world's ten worst hardcore spammers, and it survived an $11 million judgment from e360insight that was ultimately dropped in 2007. CyberBunker, the Dutch-hosted 'bulletproof' provider fronted by Sven Olaf Kamphuis, sits on the wrong side of that ledger — and Kamphuis has made the grievance theatrical, waving the Pirate Party flag outside CyberBunker's nuclear bunker even though the party itself is no party to the attacks.
The playbook is familiar: The Pirate Bay was knocked offline by an unidentified attacker in May 2012, another case where a DDoS settled a dispute between internet factions rather than extracting ransom. What distinguishes this round is scale and target — instead of silencing a pirate site, the firehose is aimed at the infrastructure that keeps spam out of inboxes.
First-order effects
- Spamhaus's blocklists are consumed by networks worldwide in real time, so sustained flooding threatens the filtering layer itself — every ISP relying on its data feels the blast radius, not just Spamhaus.
- CyberBunker and Kamphuis have publicly cast themselves as combatants against Spamhaus's blacklist, converting a listing dispute into an open attack campaign that names both sides.
Second-order effects
- Transit providers and exchange points carrying the attack traffic are forced into policing decisions — dropping or throttling customers like CyberBunker becomes a commercial question, since absorbing the flood costs money someone must pay.
- Other abuse-tolerant hosts watch how far Spamhaus's defenders will go to keep a blocklist online, which sets the price of attacking filtering infrastructure for the next aggrieved operator.
Third-order effects
- If disputes between blacklists and bulletproof hosts keep escalating to volumetric DDoS, mitigation capacity shifts from a niche service to core infrastructure every network must buy, and the arms race moves from who gets listed to whose pipes survive.
- The episode hardens a structural split in hosting: providers that enforce abuse policies versus those marketing themselves as beyond jurisdiction, with DDoS as the enforcement tool of last resort on both sides.
The trend: DDoS is shifting from extortion and protest toward retaliatory warfare between internet-enforcement bodies and the abuse-friendly hosts they blacklist, with each round raising the volume ceiling.