friendica.eskimo.com
I normally see between 4-5 hits/second on my webserver, about half of which is friendica traffic. Today it is 7.5 hits/second and the majority is friendica tag searches. These are coming from addresses all over the place so it would seem to be a botnet of some sort, but the nature of what it is doing does not make sense.
If the intent were to overload my server then I would expect those searches to be full-text searches rather than tag searches because the former are more CPU intensive.
If the intent were to use up my bandwidth, I'd expect a much higher level of attack and targets that return larger bodies of text. As it is these are only consuming less than 5% of my available bandwidth.
The level of traffic is slowly creeping up overtime. Looking up the IP addresses, MOST have no inverse DNS at all, few that do usually come back to private machines or servers in clouds.
I imagine this level of traffic might be an issue for some smaller web servers but if the intent were just to destroy I'd expect traffic at much higher levels and with a much faster ramp-up.
So I'm at a loss as to understand what is going on. Anyone have any ideas?
