DDoS-ed by a service runs on AWS

author:Wojciech Muła
added on:2022-01-29

Every year in January I download the Apache logs for my home page. I run a simple script on the logs to see which articles were popular last year. Sometimes I'm surprised that some old stuff is still being read.

The script counts the total number of visits and the unique number of visitors. And this year something strange happened. Below is the head of list:

total  uniq
651522 7864   /notesen/2021-12-22-test-and-clear-bit.html
9008   5142   /articles/simd-strfind.html
5478   3521   /notesen/2019-01-07-cpp-read-file.html
4414   3348   /notesen/2021-01-18-autovectorization-gcc-clang.html
3773   2008   /articles/simd-parsing-int-sequences.html
3270   1897   /notesen/2018-10-03-simd-index-of-min.html
2948   1870   /notesen/2019-02-02-autovectorization-gcc-clang.html
3539   1825   /articles/index.html
3843   1617   /articles/sse-popcount.html
1908   1287   /notesen/2021-03-11-any-word-is-zero.html
1982   1244   /notesen/2016-01-12-sse-base64-encoding.html
2202   1229   /articles/simd-byte-lookup.html
2060   1220   /notesen/2018-10-24-sse-sumbytes.html
2072   1202   /notesen/2021-02-02-all-bytes-in-reg-are-equal.html
1998   1103   /articles/avx512-ternary-functions.html

The trend is clear — a thousand visits is normal, few thousands is something very popular. But the top article got visited 600 thousands times! It was added on Hacker News, but never hit its main page (gained only ~30 upvotes).

Below is a daily number of visits:

/notesen/2021-12-22-test-and-clear-bit.html
2021-12-22:     360
2021-12-23:   69468 =============================
2021-12-24:  141027 ============================================================
2021-12-25:  138335 ==========================================================
2021-12-26:  137856 ==========================================================
2021-12-27:  136672 ==========================================================
2021-12-28:   27736 ===========
2021-12-29:      37
2021-12-30:      17
2021-12-31:      14
total: 651522

For whole four days, every ~2 seconds, somebody performed HTTP GET on this very URL.

I collected the IPs visiting the article. Almost all of the IPs are registered by Amazon Web Services.

Below is the detailed histogram of visits per IP. An catching-eye pattern is that the number of visits is shared across groups of different IPs. Looks like somebody did a silly synchronisation mistake and let workers pick the same same job over and over.

count    IP
5724     44.201.39.42
5724     3.94.193.105
4770     44.201.33.147
3816     54.91.111.64
3816     54.84.75.180
3816     54.221.21.59
3816     54.196.220.147
3816     54.175.245.212
3816     44.192.16.27
3816     3.87.247.68
3816     3.80.213.10
3816     3.237.21.87
3816     3.236.190.167
3816     3.236.104.169
3816     3.235.181.101
3816     18.204.227.120
2862     54.87.77.182
2862     54.85.161.10
2862     54.221.43.86
2862     54.209.115.198
2862     54.164.131.116
2862     54.161.64.49
2862     52.91.89.169
2862     52.87.191.130
2862     52.21.158.202
2862     44.200.72.132
2862     44.200.26.192
2862     44.200.187.40
2862     44.200.143.177
2862     44.197.188.220
2862     3.90.183.142
2862     3.88.173.14
2862     3.85.125.218
2862     3.84.155.160
2862     34.239.146.120
2862     34.228.40.63
2862     3.239.96.83
2862     3.239.219.229
2862     3.236.241.160
2862     3.236.207.16
2862     3.236.141.1
2862     3.236.131.194
2862     3.236.119.211
2862     3.233.219.239
2862     3.230.127.79
2862     3.227.254.57
2862     3.227.235.211
2862     3.227.11.80
2862     3.226.76.105
2862     3.220.231.2
2862     3.216.79.148
2862     18.233.148.19
2862     18.215.147.137
2862     18.214.37.67
2862     18.207.252.143
2862     18.205.159.11
2862     100.26.61.210
2862     100.26.185.13
1909     3.236.27.213
1908     54.242.255.17
1908     54.242.228.33
1908     54.242.163.248
1908     54.236.36.193
1908     54.205.82.147
1908     54.175.4.154
1908     54.174.240.173
1908     54.174.150.40
1908     54.172.41.64
1908     54.167.8.206
1908     54.167.39.17
1908     54.166.44.219
1908     54.161.206.139
1908     54.160.234.43
1908     54.159.84.255
1908     54.147.117.226
1908     50.19.161.70
1908     44.201.62.226
1908     44.201.58.131
1908     44.200.86.209
1908     44.200.65.76
1908     44.200.40.176
1908     44.200.239.183
1908     44.200.230.223
1908     44.200.227.211
1908     44.200.205.85
1908     44.200.188.45
1908     44.200.173.245
1908     44.200.171.203
1908     44.199.232.199
1908     44.197.133.168
1908     44.195.38.186
1908     44.193.83.155
1908     44.192.82.83
1908     44.192.58.57
1908     44.192.38.32
1908     44.192.131.229
1908     3.95.182.93
1908     3.95.179.4
1908     3.92.88.127
1908     3.92.190.61
1908     3.91.63.171
1908     3.91.132.53
1908     3.89.228.171
1908     3.89.141.217
1908     3.88.7.101
1908     3.88.66.222
1908     3.88.40.185
1908     3.87.80.192
1908     3.86.216.188
1908     3.85.59.14
1908     3.85.224.21
1908     3.85.162.102
1908     3.85.13.203
1908     3.84.19.250
1908     3.83.133.228
1908     3.80.68.17
1908     35.175.110.3
1908     35.174.4.162
1908     35.173.1.105
1908     35.171.146.181
1908     35.170.198.64
1908     35.168.58.80
1908     35.168.23.194
1908     35.153.39.124
1908     34.238.193.239
1908     34.236.171.38
1908     34.236.144.152
1908     34.231.21.251
1908     34.230.79.25
1908     34.229.193.190
1908     34.228.141.13
1908     34.227.111.192
1908     34.205.4.165
1908     34.201.24.65
1908     34.201.21.89
1908     34.200.237.89
1908     3.239.98.150
1908     3.239.27.216
1908     3.239.236.9
1908     3.239.195.119
1908     3.238.30.227
1908     3.238.28.93
1908     3.238.239.14
1908     3.238.233.181
1908     3.238.149.106
1908     3.237.30.128
1908     3.237.28.58
1908     3.237.197.197
1908     3.236.88.202
1908     3.236.29.198
1908     3.236.172.81
1908     3.236.113.37
1908     3.235.232.232
1908     3.234.141.7
1908     3.231.60.92
1908     3.231.219.59
1908     3.231.208.60
1908     3.227.252.65
1908     3.221.155.113
1908     3.210.205.79
1908     3.209.12.110
1908     23.20.132.70
1908     184.73.60.65
1908     184.73.57.197
1908     18.234.236.146
1908     18.234.111.35
1908     18.213.118.61
1908     18.212.159.84
1908     18.209.237.95
1908     18.208.249.16
1908     18.208.209.143
1908     18.207.104.102
1908     18.207.100.231
1908     18.206.228.51
1908     18.205.238.85
1908     18.205.107.9
1908     18.204.35.218
1908     18.204.215.122
1908     18.204.17.190
1908     100.26.147.44
1908     100.24.45.26
1908     100.24.18.194
 955     44.200.107.134
 954     54.91.114.177
 954     54.90.80.165
 954     54.90.201.186
 954     54.90.124.119
 954     54.89.101.235
 954     54.88.23.164
 954     54.86.217.46
 954     54.86.115.15
 954     54.83.241.217
 954     54.82.90.177
 954     54.82.164.242
 954     54.242.227.105
 954     54.242.140.162
 954     54.236.217.111
 954     54.227.40.231
 954     54.226.62.158
 954     54.226.122.88
 954     54.226.0.34
 954     54.221.180.78
 954     54.211.152.69
 954     54.209.207.116
 954     54.209.189.47
 954     54.208.171.144
 954     54.175.53.23
 954     54.175.195.174
 954     54.174.44.66
 954     54.166.7.228
 954     54.166.159.234
 954     54.163.187.47
 954     54.160.0.105
 954     54.157.193.120
 954     54.152.146.248
 954     54.145.24.108
 954     54.145.223.209
 954     52.91.93.152
 954     52.91.61.246
 954     52.91.226.148
 954     52.91.196.215
 954     52.90.54.249
 954     52.90.3.62
 954     52.90.192.144
 954     52.87.250.143
 954     52.87.249.92
 954     52.72.121.162
 954     52.55.65.234
 954     52.23.167.2
 954     52.23.158.119
 954     52.207.62.132
 954     52.207.250.70
 954     52.207.228.111
 954     52.202.9.106
 954     50.19.41.32
 954     44.201.7.198
 954     44.201.5.78
 954     44.201.56.67
 954     44.201.34.223
 954     44.201.31.199
 954     44.201.3.1
 954     44.201.18.138
 954     44.201.10.172
 954     44.201.0.117
 954     44.200.53.196
 954     44.200.50.199
 954     44.200.40.24
 954     44.200.39.160
 954     44.200.32.176
 954     44.200.251.208
 954     44.200.228.186
 954     44.200.218.184
 954     44.200.195.52
 954     44.200.144.107
 954     44.200.143.106
 954     44.200.137.243
 954     44.200.112.188
 954     44.199.250.90
 954     44.199.236.15
 954     44.198.59.240
 954     44.197.250.137
 954     44.197.245.138
 954     44.193.2.184
 954     44.192.84.100
 954     44.192.76.80
 954     44.192.57.38
 954     3.94.202.83
 954     3.93.81.203
 954     3.92.45.247
 954     3.92.217.211
 954     3.92.207.122
 954     3.92.132.193
 954     3.91.55.178
 954     3.91.45.166
 954     3.91.219.210
 954     3.89.55.35
 954     3.89.223.189
 954     3.89.101.5
 954     3.88.173.142
 954     3.87.219.112
 954     3.87.201.92
 954     3.87.152.148
 954     3.85.241.232
 954     3.85.13.102
 954     3.84.30.31
 954     3.83.161.181
 954     3.82.139.5
 954     3.80.79.219
 954     3.80.5.219
 954     3.80.220.39
 954     3.80.118.234
 954     35.175.200.233
 954     35.173.48.63
 954     35.173.47.212
 954     35.173.250.34
 954     35.173.134.240
 954     35.172.219.110
 954     35.172.217.161
 954     35.170.73.138
 954     35.170.64.84
 954     34.239.175.219
 954     34.239.130.54
 954     34.239.125.189
 954     34.238.83.186
 954     34.238.247.118
 954     34.238.151.112
 954     34.236.143.245
 954     34.234.223.149
 954     34.230.80.248
 954     34.229.175.140
 954     34.229.172.210
 954     34.229.168.118
 954     34.228.143.140
 954     34.227.11.197
 954     34.227.110.19
 954     34.224.41.142
 954     34.224.21.214
 954     34.207.93.237
 954     34.204.200.137
 954     34.204.189.163
 954     34.204.186.183
 954     34.203.245.120
 954     34.203.200.103
 954     34.203.199.145
 954     34.203.14.139
 954     34.200.222.190
 954     3.239.79.175
 954     3.239.76.99
 954     3.239.51.238
 954     3.239.119.61
 954     3.239.116.62
 954     3.239.11.11
 954     3.238.249.185
 954     3.238.244.136
 954     3.238.23.31
 954     3.238.228.216
 954     3.238.221.170
 954     3.238.194.160
 954     3.238.177.225
 954     3.238.150.175
 954     3.238.13.205
 954     3.238.113.12
 954     3.237.238.142
 954     3.237.10.223
 954     3.237.10.2
 954     3.237.10.145
 954     3.236.80.163
 954     3.236.54.153
 954     3.236.16.119
 954     3.236.142.65
 954     3.236.121.4
 954     3.236.120.156
 954     3.236.115.165
 954     3.236.101.79
 954     3.235.226.5
 954     3.235.199.76
 954     3.235.193.114
 954     3.235.192.58
 954     3.235.182.96
 954     3.235.178.120
 954     3.234.244.141
 954     3.234.239.170
 954     3.233.241.219
 954     3.233.234.70
 954     3.231.21.251
 954     3.230.159.197
 954     3.227.242.133
 954     3.227.11.186
 954     3.224.147.147
 954     3.223.3.71
 954     3.223.195.119
 954     3.219.217.120
 954     3.215.22.124
 954     3.209.10.196
 954     3.208.15.210
 954     184.72.114.127
 954     18.234.227.246
 954     18.234.139.137
 954     18.232.54.171
 954     18.232.177.100
 954     18.215.63.197
 954     18.215.189.70
 954     18.215.163.85
 954     18.215.159.83
 954     18.214.26.230
 954     18.212.242.2
 954     18.209.59.182
 954     18.208.195.208
 954     18.208.148.189
 954     18.207.241.17
 954     18.207.160.105
 954     18.207.143.8
 954     18.207.129.148
 954     18.206.254.83
 954     18.206.16.17
 954     18.205.105.108
 954     107.22.155.204
 954     107.22.134.56
 954     107.21.166.150
 954     100.27.49.48
 954     100.27.21.180
 954     100.26.35.56
 954     100.26.185.73
 954     100.24.25.254
 954     100.24.21.216
 954     100.24.209.103
 240     34.226.188.26
 238     3.218.212.35
 228     158.69.195.206
 173     35.203.245.218
 124     136.243.70.68

The end. :)