Last Thursday, 28 August, someone put quite a lot of effort into knocking 21percent.org offline.

Between Wednesday afternoon and Friday morning, the site absorbed 12.27 gigabytes of traffic — roughly ten times a typical week here, and almost half of it (5.88 GB) from a single country: Singapore.

Or rather, from computers pretending to be in Singapore.

The mechanics

The bulk of the traffic came from Tencent Cloud Computing (AS132203), out of two adjacent server blocks in Singapore – 1.3 million requests over seven days from thousands of different addresses, of which almost all landed in a single 24-hour window. 

But this was not just a Tencent operation. On the same day, 28 August, the identical attack signature arrived from Brazil (40,584 requests), Hong Kong (28,060), Indonesia (19,037), Mexico (13,612), Japan (11,845), Bangladesh (10,442) and Germany (9,032). Different countries, different service providers, different residential broadband and mobile ranges – but every last request bore the same fake refererral parameter and the same fake Chrome user-agent.

That is the profile of a distributed botnet: a network of compromised computers around the world, all commanded to hit the same target at the same time.

Roughly 1.5 million requests in 24 hours across those eight countries alone. For context, our normal daily traffic runs at around 3,000 human visitors.

Why?

We are, we should be clear, a peer network. We publish a few blog posts a week. We do not sell anything, we do not process payments, we have no state secrets to protect. There is nothing on 21percent.org that requires the coordinated attention of a global botnet.

Unless, of course, some of what we publish is inconvenient to somebody.

The attack came in the immediate aftermath of the Employment Tribunal ruling against senior figures at Cambridge University. It came shortly after our traffic figures crossed 90,000 monthly visits, an inflection point that appears to have caught someone’s attention. And it came from the same category of infrastructure that has been used, in the past, to silence journalists in Hong Kong, dissidents in the Gulf, and human-rights organisations across South East Asia.

We do not know who commissioned it. We do have a fairly clear idea of who benefits from our being quieter.

What we did

On observing the attack, we went offline briefly to run diagnostics and install advanced threat tracking. Origin-hitting attack traffic fell from a million requests to 27. We have filed formal abuse complaints with multiple server providers, with copies to their data-abuse and security-response teams identifying attack vectors, traffic and source origin signatures.

Total infrastructure cost of this exercise, so far: £0. Total developer time: an unusually long weekend.

What we noticed

Two small things are worth putting on record.

First, this was not a spontaneous eruption of internet weather. It was planned, coordinated, resourced, and executed. Someone paid for it. Someone was pleased with themselves on Thursday evening and rather less pleased with themselves on Monday morning.

Second, we have reason to think that the probing began well before the events of 28th August. We have been monitoring and logging botnet traffic for several months. We are compiling that into a further report.

Third, the attacker continues, unsuccessfully, to attack our site. We are grateful for this. We now have a very good source profile.  

Whoever you are — and we can now make some very informed guesses — you have paid to make our archive more resilient, our infrastructure better hardened, our story more interesting, and our readership larger. Thank you.

We will continue to publish. The Regent House is still owed answers. The victims of the last decade are still owed acknowledgement. The Vice Chancellor is still owed resignation letters from those in the senior management who have reduced our University to this sorry state.