One of my country's main TV channel has a website from which one can watch it live - in streaming. Obviously, it serves ads in the meanwhile, mainly from google partners. One night I had the website open while watching at my router logs and I noticed that - according to my router - I was being DDoSed by about 20 IP addresses.
The third level domain of the actual URL last loaded before triggering the event is listed online as a domain that a while ago had to do with the distribution/monetization of a malicious browser extension.
What the router calls "DDoS" actually consists of UDP packets being sent from random ports to random ports. The logs are not more specific and I didn't feel like forwarding all ports traffic to analyse it.
I have had a look at the machines behind those IPs and they seem to be compromised machines: they belong to various, very different, registrars and sometimes expose what look like vulnerable services (webservers, old routers interfaces, webcam controllers...).
The strangest thing is that the first time I whoised the originating IPs, most of them belong to my country (not a huge one) and the most frequent was actually from my home town - definitely not a big one! But probably it was only a coincidence since with more data the IPs seem to be distributed all over Europe.
Now I have two questions, and I hope it is appropriate to ask them here. 1) Is it what it looks to me? An ad that is either malicious or compromised and that triggers a botnet scan to recruit more machines? 2) Is this normal and common? what should one do? Ignore it? Tell the website owner? Tell the ad provider? Should/am-i-legally-allowed-to investigate more?