Security analysts have scrambled to find a motive behind the distributed denial-of-service attacks that brought down Twitter, and hit Facebook.
With little information to go on, researchers ended up speculating on who launched the attacks and why, although several agreed that Twitter's infrastructure needed immediate strengthening.
"If you monitor the hacking forums, it's clear they're pissed at Twitter," said Richard Stiennon, founder of IT-Harvest, a security research firm. "Twitter came out of nowhere. Hackers hated that. They'd been using forums and IRC to communicate, and all of a sudden, the rest of the world has their own thing in Twitter."
To Stiennon's thinking, the rise of Twitter -- and the backlash against it -- resembles the situation in the 1990s, when AOL rose to prominence, but tech-savvy users denigrated it as little more than a glorified BBS (bulletin board system).
"It's the same thing now," Stiennon said. "They look at Twitter and think, 'there goes the neighbourhood.' So they wanted to demonstrate that they could take it down and generate news at the same time."
Roger Thompson, chief research officer at AVG Technologies, has a different idea.
"I think it was a vigilante," he said, "who wants to call attention to the danger of botnets."
Thompson's theory posits that the vigilante -- perhaps a security professional -- assembled a small botnet, then aimed it at Twitter and Facebook, which was also attacked Thursday.
He based his idea on several similarities to the distributed denial-of-service (DDoS) attacks that hammered US government and South Korean commercial sites in early July.
Those attacks, at one point thought to originate from North Korea, were unfocused, had no noticeable political agenda and most important, ended with the botnet controller ordering the machines to self-destruct by wiping their hard drives.
"Who builds a botnet, then destroys it?" Thompson asked. "That's just crazy."