in the last days they started sending me once in a while a 300-400 requests per minute for the same url
with user agent of
facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
the ip and asn seems legit:
32934 2a03:2880:10ff:a::face:b00c
(just noticed all the ipv6 ends with faceb00c)
I wonder what behind thats, it annoying me triggering the ddos alerts
Is that on a domain behind Cloudflare? Are you rewriting IP addresses? Any chance you did not limit it to connections from Cloudflare?
the domain behind Cloudflare(my logs are coming from worker)… its a legit facebook bot not an attack but I dont understand what reason they have to send that many requests a minute to same url
In that case that is something only Facebook could answer. Rather unrealistic but could it be someone discovered an amplification attack via Facebook?
Yes have been seeing the same here but from various Facebook IPv4 ranges
Hello,
Since last Wednesday we’ve seen it happening on various sites which are on various servers. Many times the load skyrockets due to this.
This topic was automatically closed after 30 days. New replies are no longer allowed.
