Hacker News Reader

> The top 1 IP address that have tried hacking my blog, 54.215.171.123, originates from a location you wouldn’t suspect: Amazon.

Really? That's basically exactly what I would expect.

View on HN

I would expect Amazon to have some automated abuse controls; the rest of their infrastructure is pretty impressive.

What you're talking about requires deep packet inspection. I don't see why AWS would do that on a platform that has the potencial to generate an enormous amount of HTTP traffic.

The costs of operating something like this would have to be passed on to the client making them less competitive. No way AWS would do this.

Good point - I've not been involved in this kind of deep packet inspection required to do this – in my mind, all it would require is a filter on "wp-admin.php" and the resulting status code.

Automated? Not sure they can tell nefarious from normal traffic.

I would expect they would block the offender very quickly if notified though.

Most of the attacks are performed from other, already infected sites.

Reply on news.ycombinator.com