Jerry, (edited )
@Jerry@hear-me.social avatar

UPDATE on 216.106.86.232 :

Every few seconds, it's doing the following GETS. I'm getting about 2,000 calls per hour from this IP.

https://hear-me.social/packs/media/images/friends-cropped-40409bf96999902fa49757ebce824ce6.png

https://hear-me.social/api/v1/streaming?stream=public:local&access_token=O6luKbPRJV0FlTvhCSqn6z4wNwkUJMxUPgD7xMn4fsc

https://hear-me.social/api/v1/announcements

https://hear-me.social/api/v1/notifications?exclude_types[]=follow_request&since_id=79462

Is anyone else getting traffic from 216.106.86.232 ?

I will open a report with the ISP

=======================

I'm putting this under because I've noticed that since 12 PM EDT yesterday (30-Apr-2024), API requests coming in from 216.106.86.232 have been returning 500 errors constantly from my server. No other 500 errors were being returned.

I blocked the IP at the Cloudflare firewall and now the 500 errors have stopped. There were more than 93K 500 return codes in total until now!

I have no idea what the requests are, and it's too late at night to do more research, but I'm passing this along to other Admins as a warning and to see if anyone else is seeing similar behavior.

@Gargron

Here's what I see in Cloudflare for the last one hour before blocking the IP address. Notice all the requests returning 500 are from this single IP. There are no page views. It's all API requests. And 500 errors stopped after I blocked it.

Any insights would be appreciated.

waffles,
@waffles@masto.yttrx.com avatar

@Jerry Did you check your admin panel to see if this is a user of yours?

https://hear-me.social/admin/accounts?ip=216.106.86.232

Jerry,
@Jerry@hear-me.social avatar

@waffles
Being behind Cloudflare, it's not that easy. I only see which reverse proxy people come in from. I don't have their originating IP address.

And if they are doing something like this, they probably used a VPN to login and set up an account to hide their IP.

There's an ID though in one of the API calls, and I'm wondering if it is actually an ID that could be used to identify the account in the database they are trying to referene, which might be their own? I was thinking of investigating this on the weekend.

waffles,
@waffles@masto.yttrx.com avatar

@Jerry my server is also behind cloudflare and I'm able to get the source IP addresses with the following nginx configuration:

server {  
 listen 443 ssl http2;  
 listen [::]:443 ssl http2;  
 server_name yttrx.com;

 include /etc/nginx/cloudflare;

followed by

Jerry,
@Jerry@hear-me.social avatar

@waffles
Hmm. I am going to save this! Thanks.

But, I put in my server information that I don't track IP addresses, and so I can't use it on this server.

waffles,
@waffles@masto.yttrx.com avatar

@Jerry oh gotcha! I didn't realize that you don't track IP addresses; my assistance isn't very helpful in this case lol

Jerry,
@Jerry@hear-me.social avatar

@waffles It is for other servers I run!

freiheit,
@freiheit@digitalcourage.social avatar

@Jerry Have you tried sending an e-mail to their abuse address? According to WHOIS, it's dns@socket.net.

Jerry,
@Jerry@hear-me.social avatar

@freiheit
Thanks for doing this.

I'm going to try to see, this weekend, what they have in the payload. It might be an innocent mistake. Or, it may be malicious, and then I too will file a complaint.

I may also open a problem with Mastodon. Mastodon should not return a 500 error unless there really is a problem with the server. It probably should be returning some type of 400 error instead. It's possible I didn't configure something correctly, although I think it's likely a Mastodon issue they didn't account for.

On the weekend to-do list.

paul,
@paul@oldfriends.live avatar

@Jerry @freiheit

FYI, those URL's, except the first one with the image, are erroring out. Invalid tokens, requires authorization, etc.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • random
  • magazineikmin
  • rosin
  • Youngstown
  • mdbf
  • ngwrru68w68
  • slotface
  • khanakhh
  • ethstaker
  • everett
  • kavyap
  • thenastyranch
  • DreamBathrooms
  • tacticalgear
  • osvaldo12
  • JUstTest
  • InstantRegret
  • Durango
  • cisconetworking
  • modclub
  • cubers
  • GTA5RPClips
  • tester
  • normalnudes
  • Leos
  • provamag3
  • megavids
  • anitta
  • lostlight
  • All magazines
    •