Another weird series of HTTP requests
From 2025-12-31 to 2026-07-31,
34.39.91.209
asked for the URL /posts/economic-intelligence/
27 times a day.
From 2026-08-01 to the present,
34.39.91.209 asked for /posts/economic-intelligence/
three times a day.
Previous series of web requests, entirely different than this one.
Google’s CIDR 34.32.0.0/11 contains 34.39.91.209, indicating that 34.39.91.209 is part of Google Cloud.4.69.219.744.69.219.74
If you put http://34.39.91.209/ in your browser,
you’ll find it serves you login page for the “Ruggles Archive”.
I assume that 34.39.91.209 asks for /posts/economic-intelligence
because that’s my review of An Empirical Approach to Economic Intelligence in Word War II,
a paper written by
Richard Ruggles
and
Henry Brodie.
The Ruggles Archive wouldn’t let me create an account,
so I have no real idea if it’s actually about slightly famous
economist Richard Ruggles.
Ruggles’ papers from 1943-1990 appear to have
ended up at Yale,
which confuses things.
I seem to have posted my review of Ruggles and Brodie
at 2025-05-09T16:52:13-06:00.
34.39.91.209 first requests /posts/economic-intelligence/
on 2025-12-31T07:02:48Z, which is seven months later.
Since 2025-12-31, 810 unique IP addresses
have requested /posts/economic-intelligence/
13,112 times.
34.39.91.209 made 5807 of those requests,
and it only requested /posts/economic-intelligence/.
Only 53 IP addresses requested that URL more than 3 times,
which means that
a large part of the requests are casual web browsing.
34.39.91.209 only requested with a user agent of
rest-client/2.1.0 (linux-gnu x86_64) ruby/3.2.3p157.
It was the only IP address that sent that user agent.
As far as scheduling of requests goes, the three requests a day period has requests arriving at 05:01, 17:01 and 21:01. That’s approximate intervals of 12, 5, and 8 hours. The requests have a lot of variation at the seconds level, despite being hour and minute level consistent.
It appears that 34.39.91.209 sent requests on two overlapping schedules. Schedule 1 made a request at 3 minutes after the hour, every hour of the day. Schedule 2 made three requests a day, at 05:01Z, 17:01Z and 21:01Z.
You can see this in counts of hour-of-day of request timestamps.
| Hour of day | Requests in hour |
|---|---|
| 00 | 211 |
| 01 | 211 |
| 02 | 211 |
| 03 | 211 |
| 04 | 211 |
| 05 | 457 ← |
| 06 | 211 |
| 07 | 212 |
| 08 | 212 |
| 09 | 212 |
| 10 | 212 |
| 11 | 211 |
| 12 | 211 |
| 13 | 211 |
| 14 | 211 |
| 15 | 211 |
| 16 | 211 |
| 17 | 454 ← |
| 18 | 212 |
| 19 | 212 |
| 20 | 212 |
| 21 | 456 ← |
| 22 | 212 |
| 23 | 212 |
The scheduling reminds me of crontab schedules. It’s easy to create a schedule that runs something three minutes after every hour, and also to create multiple schedules for the same job. It’s hard to read a crontab, and a big crontab is an invitation to series of duplicated jobs.
The only barrier to me believing this series of HTTP requests
was just a couple of forgotten cron jobs
is that cron (the scheduling and execution system)
is usually consistent within a second or two.
My takeaway is that there are a lot of people with direct access to The Internet, and they do a lot of incomprehensible things. This series of requests is one of those things.