Instance aggressively posting /inbox endpoint after receiving error 403
A Pleroma Instance is aggressively posting the /inbox
of my service (every 2 seconds) after receiving error code 403 after being blocked.
Nginx Log data:
-g802d2498-develop; https://blob.cat <alexafediverse+blobcat@gmail.com>"
199.19.224.159 - - [11/Nov/2019:21:15:37 +0000] "POST /inbox HTTP/1.1" 403 78 "-" "Pleroma 1.1.50-1753-g802d2498-develop; https://blob.cat <alexafediverse+blobcat@gmail.com>"
199.19.224.159 - - [11/Nov/2019:21:15:41 +0000] "POST /inbox HTTP/1.1" 403 78 "-" "Pleroma 1.1.50-1753-g802d2498-develop; https://blob.cat <alexafediverse+blobcat@gmail.com>"
199.19.224.159 - - [11/Nov/2019:21:15:44 +0000] "POST /inbox HTTP/1.1" 403 78 "-" "Pleroma 1.1.50-1753-g802d2498-develop; https://blob.cat <alexafediverse+blobcat@gmail.com>"
199.19.224.159 - - [11/Nov/2019:21:15:47 +0000] "POST /inbox HTTP/1.1" 403 78 "-" "Pleroma 1.1.50-1753-g802d2498-develop; https://blob.cat <alexafediverse+blobcat@gmail.com>"
199.19.224.159 - - [11/Nov/2019:21:15:48 +0000] "POST /inbox HTTP/1.1" 403 78 "-" "Pleroma 1.1.50-1753-g802d2498-develop; https://blob.cat <alexafediverse+blobcat@gmail.com>"
199.19.224.159 - - [11/Nov/2019:21:15:50 +0000] "POST /inbox HTTP/1.1" 403 78 "-" "Pleroma 1.1.50-1753-g802d2498-develop; https://blob.cat <alexafediverse+blobcat@gmail.com>"
I noticed this issue after fail2ban reported that an IP Address had hit the nginxrepeatoffender jail which blocks an IP Address with iptables after receiving 500 HTTP 403/444 Statuses within 24 hours.