1

I've been getting thousands of requests each day from a specific user agent, Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0) Gecko/20100101 Firefox/38.0. They're all from different IP addresses (the ones I've looked up have been Google LLC and Cloudflare), and they all use that exact same user agent. nginx logs So far I've seen 90 unique IP addresses

ip count

I've started giving 403 statuses back to them, since it seems like something is wrong here, but I can't trace them back to any one specific point. They all seem to be legitimate requests, but they're just so suspicious with the amount of servers they're coming from. Am I missing something here?

2
  • Why do you think they are legitimate? For a start there is no referer and thise URLs look like md5 sums. Has the site been compromised? What was being returned prior to your 403? Why are you returning a 403 rather then a 404? Its not uncommon for attacks to use a pool of compromised IPs. Have you considered fail2ban to reduce the impact? – davidgo Apr 5 at 4:41
  • I thought they were legitimate because this is a json/image api, so many requests are expected as it's decently popular. Those are md5 sums, md5 sums of images hosted for said image api. I now know this is how Discord fetches images for embeds, as it fails to load images while I block these requests, so they are legitimate, Discord is just dumb and uses a browser user agent – Donovan_DMC Apr 26 at 4:24
1

I've come to find that this is Discord doing this, as it uses this user agent for fetching images for embeds (maybe the default electron user agent or something similar?), and I can tell as I started blocking requests using that user agent, images in Discord embeds that pointed to my servers started to fail to load.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.