Comment on Another massive distributed HTTP flood is currently hitting git.friendi.ca a
utzer@f.utzer.de@f.utzer.de 3 days ago
As a temporary measure, we have limited access only to the pull-request and issue-list pages currently receiving most of the traffic. The rest of git.friendi.ca should now be available again, and normal Git access is unaffected. The affected list pages may still show “Too Many Requests” while the flood continues.
Update: The flood is still ongoing and intensified again today.
Between approximately 17:50 and 22:03 CEST, Anubis recorded at least 141,090 challenges from 136,393 different IP addresses, peaking at roughly 35,800 challenges per hour.
Most of the current traffic is still targeting the friendica-addons pull-request list. Our temporary rate limit is successfully keeping this traffic away from the backend: the rest of git.friendi.ca remains fast and accessible, normal Git access works, and server load is currently back to normal.
The affected pull-request page may continue to return “Too Many Requests” while the flood persists.
Further update: I have replaced the temporary path-specific rate limit with an exact User-Agent filter.
The ten evenly rotated browser identities responsible for 96.79% of the Anubis challenges, plus the explicit `Mozilla/5.0 (compatible; crawler)` identity, are now rejected by Nginx before reaching Anubis or Forgejo.
The pull-request and issue pages are available normally again, regular web and Git access remain unaffected, and backend load is close to zero.
The crawler has since introduced a new identity:
Android 6 / Nexus 5 / Chrome 65This identity produced 527 requests from 526 different IPv4 addresses within one hour, confirming the rotating proxy-network pattern. However, the overall volume reaching Anubis has dropped from roughly 35,800 challenges per hour at the peak to about 1,000 per hour, so the exact filtering is currently working very well.
This remains a temporary mitigation because User-Agent strings can be changed at any time.
pasjrwoctx@social.2ndshot.photos 19 hours ago
did I make any sense
@pasjrwoctx Thanks, I checked the user agents. The pattern looks highly coordinated.
Out of 164,435 Anubis challenge requests, there were only 160 distinct user-agent strings. The top ten account for 96.79% of all requests and were used almost perfectly evenly:
These are old browser versions from around 2023. Combined with almost one IP per request, this looks like a single coordinated tool rotating through a fixed list of spoofed browser identities and a very large residential/proxy network. It does not prove whether the objective is scraping or disruption, but it is clearly not ordinary independent crawling.