Another massive distributed HTTP flood is currently hitting git.friendi.ca a

Submitted ⁨⁨3⁩ ⁨days⁩ ago⁩ by ⁨utzer@f.utzer.de@f.utzer.de⁩ to ⁨helpers@forum.friendi.ca⁩

Another massive distributed HTTP flood is currently hitting git.friendi.ca and causing slow responses. Operationally, this has to be treated as an application-layer DDoS attack, although we cannot determine from the logs whether disruption or aggressive scraping is the original intent.

In a fresh five-minute sample, Anubis saw 56,457 requests carrying client IPs from 50,470 different addresses:

48,519 requests via IPv4
7,938 requests via IPv6
43,621 unique IPv4 addresses
7,407 unique IPv6 addresses

We compared all addresses against the Tor Project’s official, target-specific exit list for our server on port 443. There were zero Tor exit nodes in the sample.

The traffic is spread across many networks and regions and appears more consistent with a large residential-proxy or compromised-device network than with Tor. We are investigating additional capacity protection that does not lock out legitimate users.

original

Comments

Sort:hotnew top

pasjrwoctx@social.2ndshot.photos ⁨15⁩ ⁨hours⁩ ago

@utzer @utzer ok so you could block those user agents I have something like

 # Fake browser detection
RewriteCond %{HTTP_USER_AGENT} (Chrome/[0-9]{3}|Chrome/1[3-9][0-9]|Chrome/150|Firefox/1[3-9][0-9]|Safari/60[0-9]|Version/17) [NC]
RewriteCond %{HTTP_ACCEPT_LANGUAGE} ^$
RewriteRule ^ - [G,L]

RewriteCond %{THE_REQUEST} "GET\shttp" [NC]
RewriteRule ^ - [G,L]  and then # 1. BLOCK BAD BROWSER NAMES / BOT FRAMEWORKS

RewriteCond %{HTTP_USER_AGENT} (CCBot|SearchEngineBot|Pandalytics|UCBrowser|ZoneProjectBot|Embarcadero\sURI\sClient|Xenu\sLink\sSleuth|siteradar|SignalsBot|fun-cert-watch|SERankingBacklinksBot|Pinterestbot|CMS-Checker|HeadlessChrome|Puppeteer|SeznamBot|Sogou|8LEGS|HTTrack|cherrypicker|AhrefsBot|BLEXBot|DotBot|MJ12bot|PetalBot|SemrushBot|BuiltWith|Viewer/99|Python|aiohttp|curl|Wget|libwww|Go-http-client|GeedoShopProductFinder|DuckDuckBot|node|IMJ-CompanyPage-Scraper|baidu|RootEvidence|NetAPI\sv1|Scrapy|Bingbot|SummalyBot|got|HUNT-Bot|CibraxScanner|SalesOS-CompanyVerifier|RecordedFuture|SurdotlyBot|panscient\.com|Xiaomi|Android.*Firefox|GPTBot|ClaudeBot|BardBot|LLMScraper|Firecrawl|Crawl4AI|ia_archiver|archive\.org_bot|Google|wp2shell|okhttp|Cortex-Xpanse|Mozilla\.5\.0\.compatible;\.MSIE\.10\.0;\.Windows\.NT\.6\.1;\.Trident/6\.0|facebookexternalhit|facebookexternalua|Version\.13\.0\.3\.Mobile\.15E148\.Safari\.604\.1|iPhone.*Version/13\.0\.3|Safari/604\.1|cms-scanner|OAI-SearchBot|ChatGPT-User|PerplexityBot|Perplexity-User|Amazonbot|Applebot-Extended|Meta-ExternalAgent|Meta-ExternalFetcher|cohere-ai|DeepSeek|Bytespider|Diffbot|Omgilibot|Omgili|Google-Extended|Google-CloudVertex|MistralAI-User|OAI-AdsBot|YouBot|anthropic-ai|NosibleBot) [NC,OR]
RewriteCond %{THE_REQUEST} "^[A-Z]{3,9}\s+https?://" [NC]
RewriteRule ^.*$ - [G,L]

# 2. BLOCK SPAM WEBSITES (REFERRERS)
RewriteCond %{HTTP_REFERER} (baidu\.com|bsky\.(net|com|app)|facebook\.com|meta\.com|threads\.(com|net)|instagram\.com|google\.com|googleusercontent\.com|youtube\.com|x\.com|t\.co|twitter\.com|x\.ai|bing\.com|yahoo\.com|yandex\.com|duckduckgo\.com|microsoft\.com|amazon\.com|brave\.com|semalt\.com|buttons-for-website\.com|darodar\.com|blackhatworth\.com|ilovevitaly\.com|priceg\.com|ranksonic\.com) [NC]
RewriteRule ^.*$ - [G,L]

###############################################
# SAFE BOT & SCRAPER KILLER (FRIENDICA-COMPATIBLE)
###############################################

# Kill obvious scanners by User-Agent
RewriteCond %{HTTP_USER_AGENT} (nmap|nikto|acunetix|sqlmap|fimap|nessus|openvas|arachni|wpscan|dirbuster|fuzzer) [NC]
RewriteRule ^ - [G,L]

# Kill requests with directory traversal attempts
RewriteCond %{QUERY_STRING} (\.\./|\.\.\\|%2e%2e|%5c) [NC]
RewriteRule ^ - [G,L]

# Kill malformed absolute URLs
RewriteCond %{THE_REQUEST} "^[A-Z]{3,9}\s+https?://" [NC]
RewriteRule ^ - [G,L]

# Kill empty User-Agent ONLY if NOT federation
RewriteCond %{HTTP_USER_AGENT} ^$ 
RewriteCond %{REQUEST_URI} !^/\.well-known/ [NC]
RewriteRule ^ - [G,L]

which has cut down a lot of bad traffic from getting 200, and getting hit with a 410 when it knocks on my door, I would start there, because blocking ips is fun and easy, but if they are being spoofed, they will just spoof more, and worse when they get recycled to actual valid users then you lose traffic, I have found the agent blocking is more effective, they are not willing to rewrite every script to adjust for that so for now it seems to be the fastest block, and if it is getting that hard, run it through cloudflare on the free side proxied for a while anyways to help slowdown and divert the bad traffic, it will keep your server happier, I know not everyone is a fan of that, but somtimes you have to change the route to stay on the road

original

utzer@f.utzer.de@f.utzer.de ⁨3⁩ ⁨days⁩ ago
As a temporary measure, we have limited access only to the pull-request and issue-list pages currently receiving most of the traffic. The rest of git.friendi.ca should now be available again, and normal Git access is unaffected. The affected list pages may still show “Too Many Requests” while the flood continues.
original
- utzer@f.utzer.de@f.utzer.de ⁨15⁩ ⁨hours⁩ ago
  Update: The flood is still ongoing and intensified again today.
  Between approximately 17:50 and 22:03 CEST, Anubis recorded at least 141,090 challenges from 136,393 different IP addresses, peaking at roughly 35,800 challenges per hour.
  Most of the current traffic is still targeting the friendica-addons pull-request list. Our temporary rate limit is successfully keeping this traffic away from the backend: the rest of git.friendi.ca remains fast and accessible, normal Git access works, and server load is currently back to normal.
  The affected pull-request page may continue to return “Too Many Requests” while the flood persists.
  original
  - utzer@f.utzer.de@f.utzer.de ⁨15⁩ ⁨hours⁩ ago
    is there anyone who can help to figure out if this is a huge scraping or a DDoS?
    original
    -> View More Comments