Egregoros · Phoenix Framework

Post

Remote status

Context

Phantasm

@p @graf @sun A very rare good fediblock. Scraper with a non-existent repo in UA.

EDIT: Other IPs: 81.27.102.249; 2a04:3544:8000:1000:f8c8:92ff:fec1:7d06 (see thread)

RT: https://social.grautier.eu/users/sandfrog/statuses/01KFS8VAWH4QR4FEQS3REZECWA

anime graf mays 🛰️🪐

@graf@poa.st remote

@phnt @p @sun @sandfrog >122103 requests since Jan 24 6am UTC
funny. blackholed the whole /24 just in case

Phantasm

@phnt@fluffytail.org remote

@graf @p @sun @sandfrog On my end it is mostly the v6 address I posted above and 81.27.102.249

anime graf mays 🛰️🪐

@graf@poa.st remote

@phnt @p @sun @sandfrog check for this too 110.172.148.110

110.172.148.110 - - [10/Jan/2026

55:44 +0000] "GET /users/boseph HTTP/2.0" 200 1015 "-" "Go-http-client/2.0" "Langenzersdorf" "3" "AT" "-"

110.172.148.110 - - [10/Jan/2026

55:44 +0000] "GET /users/boseph/followers?page=1 HTTP/2.0" 200 293 "-" "Go-http-client/2.0" "Langenzersdorf" "3" "AT" "-"

110.172.148.110 - - [10/Jan/2026

55:44 +0000] "GET /users/boseph/followers HTTP/2.0" 200 307 "-" "Go-http-client/2.0" "Langenzersdorf" "3" "AT" "-"

110.172.148.110 - - [10/Jan/2026

55:44 +0000] "GET /users/Auti HTTP/2.0" 200 1287 "-" "Go-http-client/2.0" "Langenzersdorf" "3" "AT" "-"

110.172.148.110 - - [10/Jan/2026

55:44 +0000] "GET /users/boseph/following HTTP/2.0" 200 333 "-" "Go-http-client/2.0" "Langenzersdorf" "3" "AT" "-"

110.172.148.110 - - [10/Jan/2026

55:44 +0000] "GET /users/BD HTTP/2.0" 200 1203 "-" "Go-http-client/2.0" "Langenzersdorf" "3" "AT" "-"

110.172.148.110 - - [10/Jan/2026

55:44 +0000] "GET /users/Ozzy HTTP/2.0" 200 1209 "-" "Go-http-client/2.0" "Langenzersdorf" "3" "AT" "-"

110.172.148.110 - - [10/Jan/2026

55:44 +0000] "GET /users/Rapist1488 HTTP/2.0" 200 1099 "-" "Go-http-client/2.0" "Langenzersdorf" "3" "AT" "-"

110.172.148.110 - - [10/Jan/2026

55:45 +0000] "GET /users/Dale HTTP/2.0" 200 1101 "-" "Go-http-client/2.0" "Langenzersdorf" "3" "AT" "-"

110.172.148.110 - - [10/Jan/2026

55:45 +0000] "GET /users/lol HTTP/2.0" 200 970 "-" "Go-http-client/2.0" "Langenzersdorf" "3" "AT" "-"

110.172.148.110 - - [10/Jan/2026

55:45 +0000] "GET /users/Cammy HTTP/2.0" 200 1444 "-" "Go-http-client/2.0" "Langenzersdorf" "3" "AT" "-"

anime graf mays 🛰️🪐

@graf@poa.st remote

@phnt @p @sun @sandfrog also 87.157.142.217, same user agent and same behavior

anime graf mays 🛰️🪐

@graf@poa.st remote

@phnt @p @sun @sandfrog 128.0.64.11

anime graf mays 🛰️🪐

@graf@poa.st remote

@phnt @p @sun @sandfrog 82.64.8.238

Phantasm

@phnt@fluffytail.org remote

@graf @p @sun @sandfrog This on has RDNS to mapper dot space hosted on yunohost, interesting.

anime graf mays 🛰️🪐

@graf@poa.st remote

@phnt @p @sun @sandfrog 5.1.64.146

anime graf mays 🛰️🪐

@graf@poa.st remote

@phnt @p @sun @sandfrog wait a minute, is some software misrepresenting itself? These are all the same Go-http-client UAs and most are all datacenters (contabo, hetzner, etc)

Phantasm

@phnt@fluffytail.org remote

@graf @p @sun @sandfrog It's a default UA for Go's http library. I have that UA on my nginx 444 list, because I kept getting retarded vuln scanners with it.

@mint@ryona.agency remote

@phnt @p @graf @sun @sandfrog Congratulations, you've blocked the bloat client.

pistolero

@p@fsebugoutzone.org remote

@mint @phnt @graf @sandfrog @sun Ha, did he?

Replying to @p@fsebugoutzone.org

@mint@ryona.agency remote

@p @phnt @graf @sun @sandfrog So it seems.
Screenshot_20260128_083953.png

Replies

Replying to @mint@ryona.agency

pistolero

@p@fsebugoutzone.org remote

@mint @graf @phnt @sandfrog @sun

bloat should probably just use a real UA anyway. I think I looked into this at one point but most of the HTTP reqs go through the dang, like, Mastodon client library. I think bloat would actually be leaner if it ignored it. FediBBS just rolled its own client and it's fine. (The only dep is the HTML parser. I don't wanna write an HTML parser.)