Requests to online services blocked by the Great Firewall of China have been redirected in recent weeks to other servers owned by a website security company.
With thousands of requests hitting their infrastructure every second, the company suspected a denial-of-service (DDoS).
Daniel Cid , co-founder of Sucuri , says the requests came from domains belonging to, among others, Facebook , Twitter , WordPress , Zendesk , Tumblr , 4shared or Flickr , and he noted that they all originated from China.
But as soon as he realized this, the first thought that crossed Cid's mind was that the company's servers were the recipient of a new type of DDoS that uses random domain names to avoid detection.
“However, the request headers looked legitimate. It also didn’t look like a DDoS that we could discern. To our surprise, they looked like actual browser requests from real users,” Cid says in a blog post.
Although the cause of this incident is still unclear, based on analysis of the logs by security experts, the general conclusion is that the Great Firewall of China may have misconfigured itself and thus directed requests from blocked websites to Sucuri 's systems .
Therefore, users in China who try to access content from restricted services will see an error message from Sucuri.
Cid reports that most of the requests were for CDN (content distribution network), images , and API files.
As for why the Great Firewall of China behaved this way, there is no answer yet, and the researcher speculates that a bug is responsible.
As customers were trying to access content from the most popular online platforms, the number of requests was unusually high and came from thousands of IP in China. Cid says a wave of this magnitude would be enough to take down most servers unless DDoS mitigation are in place, such as splitting traffic and routing to other machines.
