# Chinese Traffic to time.gif

DevFeed: [Chinese Traffic to time.gif](<https://devfeed.tech/articles/chinese-traffic-to-time-gif-30806.md>)

Original publisher: [Read original article](<https://hookrace.net/blog/chinese-traffic-time.gif/>)

Published: 2019-05-20T22:00:00Z

Content type: article

Language: en

Sources: [Dennis Felsing](<https://devfeed.tech/sources/dennis-felsing.md>)

Topics: [nginx](<https://devfeed.tech/topics/nginx.md>), [Network](<https://devfeed.tech/topics/network.md>), [Haskell](<https://devfeed.tech/topics/haskell.md>), [Linux](<https://devfeed.tech/topics/linux.md>), [DDoS](<https://devfeed.tech/topics/ddos.md>)

Tags: [cpu](<https://devfeed.tech/tags/cpu.md>), [haskell](<https://devfeed.tech/tags/haskell.md>), [http](<https://devfeed.tech/tags/http.md>), [linux](<https://devfeed.tech/tags/linux.md>), [memory-leaks](<https://devfeed.tech/tags/memory-leaks.md>), [network](<https://devfeed.tech/tags/network.md>), [nginx](<https://devfeed.tech/tags/nginx.md>), [proxy](<https://devfeed.tech/tags/proxy.md>), [server](<https://devfeed.tech/tags/server.md>)

## AI overview

The article investigates a sudden surge of traffic to an endless UTC time GIF. Logs and user-agent data indicate that much of the traffic came from WeChat and QQ users on Chinese mobile networks. The author measures the traffic's effect on a Debian VPS running nginx and a Haskell program, including high request volume, bandwidth usage, long-lived connections, and nginx connection limits, and describes efforts to keep the server running.

## Source excerpt

Nearly two years ago I posted this endless GIF that always shows the current time in UTC: Now looking at my GoAccess dashboard I can see that it is picking up in popularity rather suddenly: But strangely I can't find anything about time.gif being linked on the web. So this might just be an attempted Denial of Service (DoS) attack? At least that would be something I am familiar with from the DDNet direction, but it's certainly strange on HookRace. But instead of simply shutting down time.gif I decided to try to find out who is accessing it and whether I can keep the server up. Let's look into the nginx logs, since I use nginx to proxy the requests to the Haskell program. There I see about 40 new requests per second looking like this: hookrace.net 123.185.XXX.XXX - - [21/May/2019:21:21:27 +0200] "GET /time.gif HTTP/2.0" 200 3335 "XXX" "Mozilla/5.0 (Linux; Android 8.1.0; V1818A Build/OPM1.171019.026; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 MQQBrowser/6.2 TBS/044681 Mobile Safari/537.36 MMWEBID/XXX MicroMessenger/7.0.4.1420(0x2700043A) Process/tools NetType/WIFI Language/zh_CN" 8.055 hookrace.net 111.62.XXX.XXX - - [21/May/2019:21:21:27 +0200] "GET /time.gif HTTP/2.0" 200 32061 "XXX" "Mozilla/5.0 (Linux; Android 5.1; OPPO A59s Build/LMY47I; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 MQQBrowser/6.2 TBS/044704 Mobile Safari/537.36 MMWEBID/XXX MicroMessenger/7.0.4.1420(0x2700043B) Process/tools NetType/WIFI Language/zh_CN" 89.256 hookrace.net 111.29.XXX.XXX - - [21/May/2019:21:21:27 +0200] "GET /time.gif HTTP/2.0" 200 543830 "XXX" "Mozilla/5.0 (Linux; Android 7.1.1; OPPO R11 Build/NMF26X; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 MQQBrowser/6.2 TBS/044704 Mobile Safari/537.36 MMWEBID/XXX MicroMessenger/7.0.4.1420(0x2700043A) Process/tools NetType/WIFI Language/zh_CN" 1540.238 hookrace.net 112.2.XXX.XXX - - [21/May/2019:21:21:27 +0200] "GET /time.gif HTTP/2.0" 200 172102 "