Related to one of my theories. I nearly mentioned[1] that the pattern (at/just before midnight UTC going funny), definitely sounds a bit scheduled. There are other times, including the spate that crossed 12:00 UTC today, but Firday/Saturdy, Saturday/Sunday and Sunday/was-Today it definitely popped up.
Posting this just after midnight. As a self-disproving example. (Of course, if it's +/- some minutes, as might also be true, then still open.)
e: [1] To be precise, I was going to mention it today, but it 504ed. the irony was not lost on me.
edit2: Welll.... It went down about 00:10UTC, for between half an an hour and an hour. Shorter than prior nights. Or not yet 'free of interference' but I'm currently being lucky. Anyway, goodnight all.
Noting that (after no 504s since Christmas Eve), got locked out again from
approximately midnight (UTC) Monday 13th/Tuesday 14th January. Lasted until significantly after 01:00hrs, roused myself a bit later, and Ok again by ~03:00hrs, nothing gone wrong at any point checking from then until 04:00hrs, or the irregular checking made layer, throughout the
real morning, up until just after midday, local time.
Would completely fit with someone returning after Christmas/New Year break (academic timetable..? ...more likely than 2+ weeks completely disconnected from their desk at work if it was a business scenario, though a seasonal vacation and then a return home could have been involved as wel) and either restarting or unfreezing some (unintentionally?) disruptive DoSishly-scheduled site-scraper set to run at 00:00ish, UTC. One that they either consciously stopped/failed to refresh[1] or that crashed/hit quota without their due attention.
...maybe it's not so simple, but definitely getting that "it explains all known facts" vibe (as would there being a disruptive server-sidecbackup, but that'd be more easily identified and mitigated), so thought it worth a note.
[1] Personal experience: Early '90s,
very early web, I used a cron-job to swap in 'new' (pre-prepared) web content on my (as far as I know, never-to-be-visited) personal webspace to give it apt-for-the-date appearance and messages[2], for the approximately five people who might even know that
http://mainserver.myuni.ac.uk:8080/~myaccount/home.html existed[3][4]. On my own return to the academic grindstone, I checked, and found it was still on the Boxing Day variation (or thereabouts), apparently the servers having had a downtime, which flushed the crontabs or something of a related nature.
[2] Probably as inane as just "Happy Christmas Eve", "Happy Christmas Day", "Happy Boxing Day", several more "Happy <whatevers>" leading to "Happy New Year's Eve" and "Happy Ne..."yougettheidea!
[3] Though, realistically, possibly only one of those might have even stuck around, on campus, having no difficulties in claiming an X Windows System console and thus capable of timewasting on the nascent web (rather than gophering, or usenetting, or MUDding, or trying to KERMIT to some random shareware database, or ftp to... YGTI). Of the others, maybe one other was back visiting family but had dial-in access (but wouldn't waste their time on anything but the BBSes).
[4] I very much doubt anyone from Wollongong University ever visited my web page. Which is a shame, because I went to their Gopher site quite regularly (being rather entertained by the fact that I could, as I recall... mostly it was the reading of their bus timetables that was often my secret pleasure) and could become the highlight of my day early-hours-of-the-morning, once all the bars on my campus had shut and I once more had shoulder-room in any choice of computer lab to which I had access.