WikiLeaks war logs off Amazon's US EC2

Hounded out of US?

WikiLeaks' war logs have apparently disappeared from Amazon's Elastic Compute (EC2) US servers following calls on Monday for the US Department of Defence to launch a cyber attack on the site.

"Yesterday, two of the IP addresses used by the site belonged to Amazon EC2 instances in the United States, but these are no longer being used," wrote Paul Mutton from UK security company NetCraft.

Mutton based his information on internet records detailing sites connected to the WikiLeaks' domain specifically used for its Iraq war logs, warlogs.wikileaks.org.

WikiLeaks had apparently used Amazon's US servers to cope with expected demand for the 400,000 documents it released last Friday.

"Amazon's EC2 web service is perhaps ideally suited for sites like WikiLeaks, which may receive huge bursts of traffic when important leaks are announced," according to Netcraft's Paul Mutton.

British tech blogger Alex Norcliffe discovered last week that WikiLeaks was using five mirrored sites to deliver the Iraq war logs, including Amazon's Irish EC2 infrastructure, two locations in the US and another in France.

According to NetCraft, WikiLeaks was still using EC2 to host its main domain, wikileaks.org.

The Washington Times' editorial this week slammed WikiLeaks for its latest release and called upon the Department of Defence to launch a cyber attack that would "render inoperable the sites distributing the classified information".

"Relentless attacks on the servers and sites dispensing this classified information would have a debilitating effect on the leakers' morale and help widen the fissures that already have appeared in the group," the paper wrote.

It came after a separate piece by a FoxNews.com columnist made similar calls.

But WikiLeaks had apparently prepared for such attacks by employing a technique that was used by Microsoft in anticipation of a massive attack by the MyDoom.B virus.

"The short TTL (time to live) on warlogs.wikileaks.org is typical of any site that may need to change its location in a hurry," said Mutton.

"The 15 minute TTL on warlogs.wikileaks.org allows WikiLeaks to change the site's location relatively quickly, should any of the hosting locations be attacked or taken down."