I agree that it's not descriptive, but 400 isn't just for malformed HTTP – it covers malformed requests in general. So there's lots of opportunity for this to

I agree that it's not descriptive, but 400 isn't just for malformed HTTP – it covers malformed requests in general. So there's lots of opportunity for this to get past the basic HTTP processing of the web server and into the application code. For instance, if they had a web service to reboot a server that takes a numerical ID for an argument, but somebody passed in something other than digits – it's valid HTTP, so it would get past the HTTP level and into the application code. Presumably the attackers found areas that cause very expensive 400 failures for Linode at the application level. If I remember correctly, their web infrastructure is currently legacy Coldfusion and in the process of being rewritten. They might not have the agility/human resources to patch up these kinds of problems quickly, given the ongoing transition.