Jerry, 18 days ago (edited 18 days ago)

#MastoAdmin #MastoDev

UPDATE on 216.106.86.232 :

Every few seconds, it's doing the following GETS. I'm getting about 2,000 calls per hour from this IP.

https://hear-me.social/packs/media/images/friends-cropped-40409bf96999902fa49757ebce824ce6.png

https://hear-me.social/api/v1/streaming?stream=public:local&access_token=O6luKbPRJV0FlTvhCSqn6z4wNwkUJMxUPgD7xMn4fsc

https://hear-me.social/api/v1/announcements

https://hear-me.social/api/v1/notifications?exclude_types[]=follow_request&since_id=79462

Is anyone else getting traffic from 216.106.86.232 ?

I will open a report with the ISP

=======================

I'm putting this under #FediBlock because I've noticed that since 12 PM EDT yesterday (30-Apr-2024), API requests coming in from 216.106.86.232 have been returning 500 errors constantly from my server. No other 500 errors were being returned.

I blocked the IP at the Cloudflare firewall and now the 500 errors have stopped. There were more than 93K 500 return codes in total until now!

I have no idea what the requests are, and it's too late at night to do more research, but I'm passing this along to other Admins as a warning and to see if anyone else is seeing similar behavior.

@Gargron

Here's what I see in Cloudflare for the last one hour before blocking the IP address. Notice all the requests returning 500 are from this single IP. There are no page views. It's all API requests. And 500 errors stopped after I blocked it.

Any insights would be appreciated.