While Elon Musk claimed the “massive cyberattack” impacting X’s service had originated from Ukrainian IP addresses, security researchers note that this isn’t conclusive as attackers often obfuscate their true locations via compromised devices, proxy networks, and VPNs.
Analysts told Wired that there’s also evidence that some of X’s servers were publicly visible before being secured behind the company’s Cloudflare DDoS protection, which may have exposed the platform to direct attacks.