On Sun, Nov 09, 2014 at 07:25:39PM +0000, Fears No One wrote:
I have some news to report, along with more data.
The August DoS attempt appears to have been a crawler bot after all. An old friend came forward after reading tor-dev and we laughed about his dumb crawler bot vs my dumb "must-serve-200-codes-at-everything" nginx config. His user agent string only accounts for the spike in August, and I see no evidence of a mass crawl from it in my log reports. The 2014-09_24.old file's spike in traffic doesn't match up with his crawl times in any way, but he theorizes that somebody else maybe used the same crawler package.
I don't know the exact timing, but 9/24 would line up with HS crawl activity that was being conducted in association with the kickoff of Sponsor R work https://trac.torproject.org/projects/tor/wiki/org/sponsors/SponsorR
HTH, Paul