[boulos]

I don't know where, but as to the why: control planes usually have fairly low traffic (create an instance isn't that frequent per customer) so they'd be easier to swamp if you can get it to consider your traffic. Proper load shedding and rate limiting is kind of hard (you have to decide what you want to happen to well intentioned folks), but anyway that's probably why.

[andruby]

Maybe this attack is part of a plan to get access to the control panel of customers. That would be a way to gain access to some relatively high profile sites.

[gcb0]

more likely just DoSing as a way to prevent people already hacked from bringing hosts down.