pov: you exist on the internet

[whitequark@social.treehouse.systems]

@iacore grafana

[whitequark@social.treehouse.systems]

okay, now it is not fine. holy shit who does this

[jackeric@beige.party]

@whitequark

[pleaseclap@techhub.social]

@whitequark I'm just a fan of your work

[whitequark@social.treehouse.systems]

@jackeric I'm hosting a service like github pages and one of the backend nodes received 40K requests per minute for half a hour straight, totally saturating the CPU

[scy@chaos.social]

@whitequark Assholes, Catherine. Assholes do that.

[aburka@hachyderm.io]

@whitequark AI scrapers

[bakachu@infosec.exchange]

@whitequark that activity heatmap graph is really great though, i need to learn how to make those myself...

[whitequark@social.treehouse.systems]

this time it looks like actual targeted abuse with an endless stream of random domains none of which resolve to my A/AAAAs

(that or someone failed writing a scraper really hard maybe)

[whitequark@social.treehouse.systems]

doing a quick and surface-level post-mortem it looks like most incoming requests were handled fine but the outgoing (storage) requests started piling up after a while

if i end up getting hit by these waves a lot i'll have to invest either in beefier machines or some sort of fast domain set inclusion check

[whitequark@social.treehouse.systems]

upon closer examination of the traffic it seems more likely that someone downloaded the cloudflare top 1M domain list and then hit grebedoc with spoofed Host: header for a big chunk of them