Report a DDoS Attack: Police, CERTs and Your Provider

Most organisations hit by a DDoS never report it. The site recovers, the attacker is probably abroad, and filing feels like paperwork with no payoff. That reasoning misses two things. Investigators build cases by connecting many small reports, and yours may be the one that links a campaign together. And the people who’ll later ask questions (insurers, auditors, a large customer) want to see a case reference, not a shrug.

Why report a DDoS attack at all

Reporting has several audiences, and they want different things:

Your provider comes first in practice, because they can actually reduce the traffic. The others matter for what happens afterwards.

Save the evidence before logs rotate

Default log rotation on many Linux servers keeps one or two weeks, and a busy attack can fill disks faster than that. Preserve evidence during the attack or immediately after.

Checklist:

• Web server access and error logs for the whole window, plus an hour before
• Firewall and fail2ban logs
• CDN or WAF exports (in Cloudflare: Security Events and analytics, as CSV or screenshots)
• Bandwidth and packet graphs from your host or monitoring
• Provider ticket numbers and their emails
• Extortion emails with full headers, untouched
• An outage timeline with times and time zone
• A first damage estimate

Bundle the files and record checksums so nobody can later question their integrity:

mkdir -p ~/ddos-evidence-2026-10-18
cp /var/log/nginx/access.log* /var/log/nginx/error.log* ~/ddos-evidence-2026-10-18/
journalctl --since "2026-10-18 09:00" --until "2026-10-18 14:00" > ~/ddos-evidence-2026-10-18/journal.txt
cd ~/ddos-evidence-2026-10-18 && sha256sum * > SHA256SUMS

Write down whether server clocks run on UTC or local time. A one-hour offset between your logs and your provider’s will otherwise cost you a round of confused emails.

Export ransom emails as .eml files. Forwarding strips or rewrites the original headers, which are what investigators actually trace. Don’t reply, not even to stall.

Who to report a DDoS attack to

Your provider. Use the NOC or abuse contact rather than general support if one exists. Ask specifically for upstream filtering or scrubbing and get a ticket number.

Law enforcement. Most countries have either an online reporting portal for cybercrime or a national unit that takes reports from businesses. Small businesses and individuals can usually file with local police. If an extortion deadline is running, say so, because it changes the urgency.

A useful report includes:

1. Start and end time with time zone
2. Affected domains, IP addresses and services
3. What broke (site down, checkout failing, email unavailable)
4. What you know about the sources: top IPs, networks, countries from your logs
5. Any extortion messages
6. Estimated damage
7. A contact who can answer follow-up questions

Don’t expect an arrest next week. Do expect to be asked for original logs.

Your national CERT or CSIRT. Many accept voluntary reports and use them to warn others. They won’t investigate for you, but they sometimes know whether the same attack is hitting your sector right now.

Mandatory reporting: NIS2 and sector rules

In the EU, Article 23 of the NIS2 Directive requires essential and important entities to report significant incidents to their CSIRT or competent authority: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, and a final report within one month of that notification. National laws implement the details, so check your own country’s version and authority.

Outside the EU, sector regulators (finance, telecoms, health, energy) often have their own rules. Work out whether you’re in scope before an incident. The 23rd hour of an outage is a bad time to read legislation.

DDoS extortion: what to do with the email

Ransom DDoS tends to follow a script. A short demonstration attack, then an email naming a deadline, an amount in cryptocurrency and a threat of something much bigger. Sometimes nothing follows the deadline at all.

My advice is not to pay. It funds the next round and puts you on a list of targets that pay. Use the deadline instead to get protection in front of the site, for example Cloudflare DDoS protection or your provider’s scrubbing. The technical first steps are in what to do during a DDoS attack.

Putting a number on the damage

Police and insurers will both ask what the attack cost. A calculation built from lost revenue per hour, staff hours and extra spend is far more credible than a round figure. The guide on the cost of a DDoS attack walks through it. To describe the attack technically, the signals in how to detect a DDoS attack give you the right vocabulary.

After the report: harden the domain, too

Targets get retargeted. Once things are calm, look beyond the web server: is your registrar lock on, is DNSSEC configured, and who exactly can log in to your registrar account? The domain security guides at betadomain cover those basics. You can also register or move a .com with DNSSEC and full nameserver control, at the fixed renewal rates on the betadomain price list.

Step by step

1. Preserve evidence during the attackCopy web, firewall and CDN logs, traffic graphs and provider tickets with timestamps and time zone, and record checksums.
2. Keep extortion messages intactExport emails as .eml with full headers, save chat messages, and do not reply.
3. Notify your providerContact your hosting or upstream provider's NOC or abuse desk, ask for filtering and get a ticket number.
4. File a police reportReport to local police or the national cybercrime unit with timeline, affected systems, evidence and estimated damage.
5. Check regulatory deadlinesConfirm whether NIS2 or sector rules apply. If they do, send the early warning within 24 hours and the full notification within 72 hours.