Login
You're viewing the suncoast.dev public feed.
  • Andrew :hokkaido: :famichiki:piepants@famichiki.jp
    Aug 16, 2026, 6:49 AM

    One nice thing about storing NGINX logs in json is that it makes some powerful analysis possible using simple tools such as jq. Doing a bit of filtering to only the 429 requests reveals a couple of interesting things.

    1. These are all from what appears to be residential IPs, mostly in China but with scattered hits from Russia, Ukraine, the US and others.
    2. They're all using the same generic user agent, imitating Chrome.
    3. They're all requesting specific URLs - mostly the tags API

    Sample of the filtered data showing user agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36", request URLs mostly to /api/v1/tags or /api/v1/trends, and locations almost exclusively in China.
    💬 1🔄 0⭐ 1

Replies

  • Andrew :hokkaido: :famichiki:piepants@famichiki.jp
    Aug 16, 2026, 6:52 AM

    It makes sense that scrapers would go for those endpoints - after all, you can get a fair bit of public post data from them, not just on our server, but across the entire fediverse (note - this is only *public* posts)

    Hmm. I wonder if it's possible to restrict that to logged in users only.

    Sample of the data returned by a request to the /api/v1/timelines/tag endpoint
    💬 1🔄 0⭐ 1
  • 💬 2🔄 0⭐ 1
  • 💬 0🔄 0⭐ 1
  • Andrew :hokkaido: :famichiki:piepants@famichiki.jp
    Aug 16, 2026, 7:16 AM

    Interesting, but not unsurprising. Configured a managed challenge rule for those conditions, and there's currently a 0% success rate. Will keep an eye on the log and Sidekiq dashboards to see if there's a drop in traffic and server load with the new rule.

    Security rule showing that if the request is from China or using a specific user agent, to issue a managed challenge. It's listing a 0% success rate for 87 requests.
    💬 0🔄 0⭐ 0