<unnamed>

Public Key

npub1fz7dvz9xfj4acxcsfu4nr57wafmjxj0ry9cwt8ee99s6zcc8wsjsqd8cv8

Profile Code

nprofile1qqsy30xkpznye27urvgy72e3608w5aerf83jzu89nuujjcdpvvrhgfgprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntryx4nx

Publishing to

relay.momostr.pink

Last Notes

2025-04-07 20:34:01 CEST

I'm having trouble figuring out what kind of botnet has been hammering our web servers over the past week. Requests come in from tens of thousands of addresses, just once or twice each (and not getting blocked by fail2ban), with different browser strings (Chrome versions ranging from 24.0.1292.0 - 108.0.5163.147) and ridiculous cobbled-together paths like /about-us/1-2-3-to-the-zoo/the-tiny-seed/10-little-rubber-ducks/1-2-3-to-the-zoo/the-tiny-seed/the-nonsense-show/slowly-slowly-slowly-said-the-sloth/the-boastful-fisherman/the-boastful-fisherman/brown-bear-brown-bear-what-do-you-see/the-boastful-fisherman/brown-bear-brown-bear-what-do-you-see/brown-bear-brown-bear-what-do-you-see/pancakes-pancakes/pancakes-pancakes/the-tiny-seed/pancakes-pancakes/pancakes-pancakes/slowly-slowly-slowly-said-the-sloth/the-tiny-seed
(I just put together a bunch of Eric Carle titles as an example. The actual paths are pasted together from valid paths on our server but in invalid order, with as many as 32 subdirectories.)
Has anyone else been seeing this and do you have an idea what's behind it?
#botnet #ddos #webscraping #infosec