-snip-
Is the list that you've provided from your own node?
Yes, the IPs came from my new node. The old one does not seem to have this problem. I think its because its at its limit of connections anyway.
Any ideas on why anyone would do this? What could possibly be gained for these asshats? I don't get it.
seems like someone is trying to provoke people into banning amazon/cloud hosting services.
in all honesty. i see it as a good thing. no one should be running a full node on amazon/cloud hosting anyways, so if it has taken a crap DDoS attempt to prompt people to block these, then ultimately its a good thing
Maybe. I usually dont like to outright ban an entire ISP (or hoster) just because someone is misbehaving. Their stupid report form does not even have a section "(D)DoS" though and they specificially asked for reports on this on twitter, yet the attacks continue. It boils down to my priorities and dealing with a low impact attack is very low on a long list. If there are new connections tomorrow, I will increase the ban time, probably to a month and just ban the entire amazon IP range. I know there are legit full nodes running via amazon, but as you said maybe they shouldnt in the first place.