9 ms·

Many years ago, some person misconfigured their squid proxy and was hitting https://jsonip.com https://jsonip.com to the point my server at the time was turning

by geuis 3y ago

Many years ago, some person misconfigured their squid proxy and was hitting https://jsonip.com https://jsonip.com to the point my server at the time was turning green in the gills. I started responding with 418 "You are a tea kettle" or something like that to those specific requests. The originating dev actually paid attention to their error messages and quickly resolved their config issue. Fast forward to March this year. Some fucking numb nuts a-hole decided to add jsonip.com to an EXTREMELY widely used version of Dalvik/Android software that gets deployed to hundreds of thousands or millions of devices. Overnight my traffic levels increased by 300%. I'm a solo dev offering a free service for 12 years. That kind of increase in traffic costs me money I've never had to plan for. I ended up switching to Cloudeflare to handle the load with a WAF filter on the offending android tvs and other devices. However Cloudflare doesn't properly route ipv4 address because "ipv6 is cool so we only do that" or something. Despite numerous support requests, that's still shmaybe an enterprise level feature. I apologize to any long time users of the service. This was completely unexpected after more than a decade. I've been trying different "fixes" for 2 months and have not resolved a way to block this garbage traffic and still provide the original services. Yea sorry I turned this funny old internet post about the mit coffee pot into a thing happening to me. But if for some ungodly reason you're the dev or know who did it, REMOVE MY SERVICE ADDRESS FROM YOUR OUT OF DATE FROM TV/SMART DEVICE ANDROID code. You're literally fucking killing me. I've literally spend dozens of hours trying to find out if this was a contribution to a public source repo. Nothing. Based on the Dalvik user agent, I only found a handful of references in Chinese repos. But google search is so terrible these days, even those are false flags. So I have no idea who to contact about this. Some dipshit on your team(s) decided to abuse a free service as though there isn't a single human person behind it absorbing the costs and making sure it runs.

christiangenco 3y ago
Sounds like you’ve built a valuable service that large companies are using in production! Why not start charging for it?
- geuis 3y ago
  Have been thinking about it for a couple years. People generally don't realize the complexity that gets added when you start charging money for something.
Dalewyn 3y ago
>as though there isn't a single human person behind it absorbing the costs and making sure it runs. Obligatory https://xkcd.com/2347/ https://xkcd.com/2347/
- geuis 3y ago
  You are a legend. Many hugs.
ozr 3y ago
You're a better person than me. I'd start returning nonsense like `999.9` to see if I could trigger a ton of bug reports for someone.
- lloeki 3y ago
  other evil ideas: - return a 200 with broken JSON, possibly triggering parse errors or exceptions in the caller - return a payload that generates catastrophic resource consumption on the other end, e.g Content-Encoding: gzip and feed it a deflate bomb - hack TCP and/or TLS to leave the other end waiting/stalling in an attempt to rate limit (timeout) or starve resources (ulimit) on the other end (e.g abuse 3 way handshake)
  - ransackdev 3y ago
    The site advertises itself as free for all and unlimited usage. To suddenly return malicious responses to intentionally break these apps might very well be illegal in many countries, or maybe would make them liable for damages claims. These clients are not violating any TOS or doing anything not allowed, after all.
    - lloeki 3y ago
      I said "evil" for a reason. That said, it seems like a _single_ actor is causing 300% cost increase compared to _every other actor combined_. Even if advertised as free, there's decency to be had. If I lend someone my home without TOS and say "make yourself at home" there's a reasonable common sense expectation from both parties that visitors should not turn on every water tap and electric device full blast 24/7, because that would be damaging to me in the first place. Given the scale of the purported app causing this it's very much abuse in its own right, whether intentional, misengineering, or an oversight. The author of jsonip.com seems to have taken every precautionary measure to limit damage and identify perpetrators to reach out, and these failed. Ethically I feel it would be only fair to displace damage from their infra to the app in order to protect themselves. The only alternative is to shutter the service as it's essentially experiencing a financial DDoS.
takenpilot 3y ago
https://jsonip.com/about https://jsonip.com/about Neat!
dannyw 3y ago
Your website on https://getjsonip.com/ https://getjsonip.com/ says: > Supports unlimited requests and is free. Maybe update that text? There is no guidance on acceptable thresholds, rate limits, etc.
- d0ugal 3y ago
  That appears to be a different URL
  - 8organicbits 3y ago
    One is a marketing and docs site, the other is the "api".
- geuis 3y ago
  Yeah I know. That is a legit critique. What's been happening is your essential black swan event. I've been running the service for 12 years and have never had this problem. There are hundreds of websites and independent users that have never abused the api like this until March. I have always been able to absorb the traffic impact. This is different. Someone wasn't thinking and randomly added the domain to a lazy piece of code somewhere that got deployed to millions of devices pretty much over night. The only way I've been able to keep jsonip active is by incorporating Cloudflare. But they don't actually solve the problem. As a corporation, they treat ipv4 addresses like 3rd class citizens. Anyway yeah I've been evaluating changing the TOS, requiring registered signins, etc. But NONE of those fixes a 300% level of traffic that's been hitting the service for months now. I can change the verbiage all I want. But it does absolutely nothing to stop the a-hole dev from China or wherever that rolled out an update to hundreds of thousands of millions of devices with simply emailing me if that's ok. I've literally, and successfully, run the service for free to the public because no one has done this before. And to the nginx people. No, returning 444 doesn't seem to fix the problem. I've tried. It doesn't work.
  - bierjunge 3y ago
    Unethical tip: start returning the content of this article [0] to these devices. The Chinese government will "fix" the devs for you or simply block all traffic to your site. [0] https://en.wikipedia.org/wiki/1989_Tiananmen_Square_protests_and_massacre https://en.wikipedia.org/wiki/1989_Tiananmen_Square_protests...
mrweasel 3y ago
Could you start returning wrong answers, "country":"TW" should do it. We had to deal with image scrapers who didn't respond to requests to stop, even if we provided an API service. I configured nginx to just serve them images of a beaver and a few 1GB junk files, they stopped pretty quickly.
pkphilip 3y ago
Sorry but I laughed aloud at all the swearing! But yes, I empathise complelely with your situation. People abusing someone else's free service really gets my goat. I hope this situation is resolved soon. I do agree with one of the other comments - returning something about Taiwan or Tiannenmen square may do the trick
ricardobayes 3y ago
No, sorry this is 100% on you. You should have implemented throttling, and daily query limits. Once you put something on the internet for free, you can't complain then if people are using it.
- misnome 3y ago
  You absolutely can. Nobody has an obligation to serve you if you are an asshole.
  - johnisgood 3y ago
    Why complain instead of mitigating? Or why not complain AND mitigate at the very least? Do not serve it to assholes?
    - misnome 3y ago
      > Or why not complain AND mitigate at the very least? You mean, like they say they have been trying to do, in the complaint?
      - johnisgood 3y ago
        I am replying to you saying that "you absolutely can [complain]". The comment to which I replied simply states that you can complain. Sure, you can. shrugs
    - wiseowise 3y ago
      I’ll never understand “no complain” argument. Person has a valid complaint, goddamnit, they have all the rights to complain.
      - johnisgood 3y ago
        Sure, feel free to complain away if that makes you feel better.
- 3y ago
gnfargbl 3y ago
Unfortunately, this seems to be the pattern that people offering the same service as you experience. Take a look at https://major.io/2021/06/06/a-new-future-for-icanhazip/ https://major.io/2021/06/06/a-new-future-for-icanhazip/, if you haven't seen it already.
- geuis 3y ago
  Thanks for the link. That's like reading something from a really scary personal future.
ransackdev 3y ago
icanhazip.com had similar issues. Cloudflare took over the project https://major.io/2021/06/06/a-new-future-for-icanhazip/ https://major.io/2021/06/06/a-new-future-for-icanhazip/ Fyi, dns can be used to obtain public ip from large companies, without the overhead of tcp and http dig +short txt ch whoami.cloudflare @1.0.0.1 dig +short txt o-o.myaddr.l.google.com @ns1.google.com dig +short myip.opendns.com @resolver1.opendns.com
- KomoD 3y ago
  What does the "ch" mean?
Mandatum 3y ago
That’s typically why it’s a good idea to include a crappy “generate API” key button so you can block traffic like this, you don’t even need a registration process - someone can just email with reference to their API key to discuss their issues.
- usrbinbash 3y ago
  > you don’t even need a registration process You should put it behind a CAPTCHA of some sort however, otherwise, some smartass will just write a "library" auto-fetching an api key as soon as the one it has currently cached stops working. And yes, that is an annoyance to users, but so what? Please direct all complaints to the comparatively small number of people responsible for the fact that the rest of us cannot have nice things.
  - Etheryte 3y ago
    This is not really a problem, you can easily disable generating new keys and sidestep the problem. Everyone who's legit can keep using their old keys.
  - ransackdev 3y ago
    CAPTCHA is for humans while this json service is for machines
n0n0n4t0r 3y ago
Wikipedia had a similar situation with a single flower image being requested so many times. I can't find the story and don't remember it well, but I think it was a big indian company using this image to check if internet was available. IMHO, one of the problems is that many dev. don't realize both the size of their company and the impact of so many requests. I hop you'll find a solution, and thank you for your service! PS: maybe you should create a dedicated post about this subject to attract visibility
- parekhnish 3y ago
  Oh yes! I remember that! [1]: Wikimedia Phabricator link: https://phabricator.wikimedia.org/T273741 https://phabricator.wikimedia.org/T273741 [2]: HackerNews thread: https://news.ycombinator.com/item?id=26072025 https://news.ycombinator.com/item?id=26072025
danpalmer 3y ago
> However Cloudflare doesn't properly ... Despite numerous support requests, that's still shmaybe an enterprise level feature. This matches my experience. I'd use the CF free plan assuming no guarantees for a low risk site like my personal site, and I'd use the expensive enterprise plan where I'm paying individually for features and quota, but I'd never use the middle-ground "sure it's unlimited!" plan – it's far too vague about what it _actually_ provides.
- TallGuyShort 3y ago
  Ironically, "sure it's unlimited" is now a thing the parent comment has probably learned not to say too.
megablast 3y ago
> literally fucking killing me Wow, that's crazy.
netsharc 3y ago
> You're literally fucking killing me. Literally being killed? Call the police!!!11
ransackdev 3y ago
> That kind of increase in traffic costs me money I've never had to plan for. https://getjsonip.com/#plus https://getjsonip.com/#plus Going further with jsonip Plus With the upcoming Plus service, you get special features and even more information about your users. - All of the free service features - IP geo location - Country and city to within best available accuracy - ISP Info - Time zone data - Full referer data - Browser and OS info https://web.archive.org/web/20200811215649/https://getjsonip.com/#plus https://web.archive.org/web/20200811215649/https://getjsonip... A paid service has been "upcoming" since at least August 2020, which would subsidize the free tier usage you allow on your site. Aside from the ISP and geo data, everything else is given to you in the request headers or can be determined with the ip address (geo can get tz). If it's costing you money, shipping the Plus features might offset your out of pocket expenses. This is a failure of growth/capacity planning and lack of a proper TOS that clarifies "unlimited within reason and at our sole discretion with no SLA or warranty of any kind for non-paying users", as well as failure to ship any monetizing features 3 years after announcing it. Contacting them to have them stop wouldn't solve your problems. What happens when the next million devices get random updates from literally anybody that starts doing it again? Try to implement rate limiting, optimize your hot code paths, watch out for slow clients (buffered reverse proxies), needless header parsing, slow template rendering, etc. Any language capable of concurrency should be able to handle 100s of thousands of requests on a cheap vm. The client ip is coming to you in the request headers and all you do is print it back to them... A go handler would be a few lines of code to do this and that's including dealing with reverse proxy real-ip type stuff. You don't need to allocate an actual struct and serialize into a json object, just printf a hardcoded string with a replacement for the ip from the header, or better yet benchmark the fastest solution. I'll do it for you, I'm looking for a job ;)
- deleted 3y ago
  [deleted]
- manfre 3y ago
  You assumed the issue relates only to compute costs. Even with a small payload, bandwidth fees can add up quickly when millions of clients are polling.
timbuchwaldt 3y ago
We see your exact Dalvik problem on deepl.com as well. We get a constant flood of those requests, sometimes subsiding. They are globally distributed, preliminary in lower-income countries. We have tried lots of things, like letting them just time out, returning different errors, redirecting of many sorts including Android intents, no solution. They now made it to our permanent blocklist and we just deal with the useless additional traffic. We are still hyper curious what on earth is loading us and for what reason though. AFAIK we couldn't see translation requests from them, just loading our website.
- ransackdev 3y ago
  Welcome to the internet. Install pfsense/opnsense and run your own firewall at home and you'll be shocked at the flood of non-stop portscans hitting your ip getting blocked. This is par for the course and there is nothing you can do to prevent it, you have to build systems able to mitigate, offload, block bad actors. This will always be the case. Any free service that has utility will be quickly scripted against and used to make someone else money. Build accordingly
- ransackdev 3y ago
  You mentioned low income countries. This could be infected devices running ancient unpatched OSes, but what if the traffic is legit, coming from impoverished countries who found your service and use it to teach their children and learn things they'd otherwise not have access to? Personally I would deep dive the traffic and try to determine the intent behind it, you could be destroying a future generation's potential, and not blocking malware I'm assuming you can correlate the requests from those ips with that they are translating. Odds are someone is hitting your service to translate for their paid service, but if it's an important part of a poor country, I'd find a way to allow it to keep happening > AFAIK we couldn't see translation requests from them, just loading our website. Browser homepage? Or maybe the unlucky victim of a "connectivity check/am I online" recurring task
- geuis 3y ago
  That's interesting. The traffic sources hitting me seem to be the opposite. Mainly US, Western Europe, and other better well to do places around the world. I suspect a lot of the traffic is from apps on smart devices. I've seen user agents that reference Bravia tvs for example.
RobotToaster 3y ago
I hate to add to your headache, but multiple pihole ad blacklists contain your domain. It looks like https://winhelp2002.mvps.org/ https://winhelp2002.mvps.org/ may be the original source of the blacklisting.
- ransackdev 3y ago
  pihole and other dns blocklists would reduce traffic to their service, not increase it
  - nickjj 3y ago
    Yeah but it means their service is less valuable. If adblockers block traffic to that domain then there's less incentive to pay for the service because an undetermined but ever growing percentage of traffic will block it. Now it's a headache for a different reason.
- News-Dog 3y ago
  hosts file (modified) sourced from; Steven-Black - hosts @GitHub : https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts cat /etc/hosts |grep -i 'jsonip.com' 0.0.0.0 jsonip.com 0.0.0.0 www.jsonip.com
jgrahamc 3y ago
I’d love to know more about “However Cloudflare doesn't properly route ipv4 address because "ipv6 is cool so we only do that" or something. Despite numerous support requests, that's still shmaybe an enterprise level feature.” jgc@cloudflare.com if you can share your interactions with us.
ransackdev 3y ago
Couple things to consider 1. Check your competitors who return json and see if they have a Location header 301'ing or 302'ing all their traffic to your service (if the client follows redirects). 2. Reverse dns lookup your origin ips and see if anyone has a domain's dns pointed at your service. Check the Host header on your end and make sure it's your domain as well as ensure your web server and/or proxy are not blindly accepting traffic for `*`/any host, and make sure it's serving only your host 3. Ip address headers can be spoofed. It might not be coming from where you think it's coming from

by geuis 3y ago

christiangenco 3y ago

Sounds like you’ve built a valuable service that large companies are using in production! Why not start charging for it?

geuis 3y ago
Have been thinking about it for a couple years. People generally don't realize the complexity that gets added when you start charging money for something.

Dalewyn 3y ago

>as though there isn't a single human person behind it absorbing the costs and making sure it runs. Obligatory https://xkcd.com/2347/ https://xkcd.com/2347/

geuis 3y ago
You are a legend. Many hugs.

ozr 3y ago

You're a better person than me. I'd start returning nonsense like `999.9` to see if I could trigger a ton of bug reports for someone.

lloeki 3y ago
other evil ideas: - return a 200 with broken JSON, possibly triggering parse errors or exceptions in the caller - return a payload that generates catastrophic resource consumption on the other end, e.g Content-Encoding: gzip and feed it a deflate bomb - hack TCP and/or TLS to leave the other end waiting/stalling in an attempt to rate limit (timeout) or starve resources (ulimit) on the other end (e.g abuse 3 way handshake)
- ransackdev 3y ago
  The site advertises itself as free for all and unlimited usage. To suddenly return malicious responses to intentionally break these apps might very well be illegal in many countries, or maybe would make them liable for damages claims. These clients are not violating any TOS or doing anything not allowed, after all.
  - lloeki 3y ago
    I said "evil" for a reason. That said, it seems like a _single_ actor is causing 300% cost increase compared to _every other actor combined_. Even if advertised as free, there's decency to be had. If I lend someone my home without TOS and say "make yourself at home" there's a reasonable common sense expectation from both parties that visitors should not turn on every water tap and electric device full blast 24/7, because that would be damaging to me in the first place. Given the scale of the purported app causing this it's very much abuse in its own right, whether intentional, misengineering, or an oversight. The author of jsonip.com seems to have taken every precautionary measure to limit damage and identify perpetrators to reach out, and these failed. Ethically I feel it would be only fair to displace damage from their infra to the app in order to protect themselves. The only alternative is to shutter the service as it's essentially experiencing a financial DDoS.

takenpilot 3y ago

https://jsonip.com/about https://jsonip.com/about Neat!

dannyw 3y ago

Your website on https://getjsonip.com/ https://getjsonip.com/ says: > Supports unlimited requests and is free. Maybe update that text? There is no guidance on acceptable thresholds, rate limits, etc.

d0ugal 3y ago
That appears to be a different URL
- 8organicbits 3y ago
  One is a marketing and docs site, the other is the "api".
geuis 3y ago
Yeah I know. That is a legit critique. What's been happening is your essential black swan event. I've been running the service for 12 years and have never had this problem. There are hundreds of websites and independent users that have never abused the api like this until March. I have always been able to absorb the traffic impact. This is different. Someone wasn't thinking and randomly added the domain to a lazy piece of code somewhere that got deployed to millions of devices pretty much over night. The only way I've been able to keep jsonip active is by incorporating Cloudflare. But they don't actually solve the problem. As a corporation, they treat ipv4 addresses like 3rd class citizens. Anyway yeah I've been evaluating changing the TOS, requiring registered signins, etc. But NONE of those fixes a 300% level of traffic that's been hitting the service for months now. I can change the verbiage all I want. But it does absolutely nothing to stop the a-hole dev from China or wherever that rolled out an update to hundreds of thousands of millions of devices with simply emailing me if that's ok. I've literally, and successfully, run the service for free to the public because no one has done this before. And to the nginx people. No, returning 444 doesn't seem to fix the problem. I've tried. It doesn't work.
- bierjunge 3y ago
  Unethical tip: start returning the content of this article [0] to these devices. The Chinese government will "fix" the devs for you or simply block all traffic to your site. [0] https://en.wikipedia.org/wiki/1989_Tiananmen_Square_protests_and_massacre https://en.wikipedia.org/wiki/1989_Tiananmen_Square_protests...

mrweasel 3y ago

Could you start returning wrong answers, "country":"TW" should do it. We had to deal with image scrapers who didn't respond to requests to stop, even if we provided an API service. I configured nginx to just serve them images of a beaver and a few 1GB junk files, they stopped pretty quickly.

pkphilip 3y ago

Sorry but I laughed aloud at all the swearing! But yes, I empathise complelely with your situation. People abusing someone else's free service really gets my goat. I hope this situation is resolved soon. I do agree with one of the other comments - returning something about Taiwan or Tiannenmen square may do the trick

ricardobayes 3y ago

No, sorry this is 100% on you. You should have implemented throttling, and daily query limits. Once you put something on the internet for free, you can't complain then if people are using it.

misnome 3y ago
You absolutely can. Nobody has an obligation to serve you if you are an asshole.
- johnisgood 3y ago
  Why complain instead of mitigating? Or why not complain AND mitigate at the very least? Do not serve it to assholes?
  - misnome 3y ago
    > Or why not complain AND mitigate at the very least? You mean, like they say they have been trying to do, in the complaint?
    - johnisgood 3y ago
      I am replying to you saying that "you absolutely can [complain]". The comment to which I replied simply states that you can complain. Sure, you can. shrugs
  - wiseowise 3y ago
    I’ll never understand “no complain” argument. Person has a valid complaint, goddamnit, they have all the rights to complain.
    - johnisgood 3y ago
      Sure, feel free to complain away if that makes you feel better.
3y ago

gnfargbl 3y ago

Unfortunately, this seems to be the pattern that people offering the same service as you experience. Take a look at https://major.io/2021/06/06/a-new-future-for-icanhazip/ https://major.io/2021/06/06/a-new-future-for-icanhazip/, if you haven't seen it already.

geuis 3y ago
Thanks for the link. That's like reading something from a really scary personal future.

ransackdev 3y ago

icanhazip.com had similar issues. Cloudflare took over the project https://major.io/2021/06/06/a-new-future-for-icanhazip/ https://major.io/2021/06/06/a-new-future-for-icanhazip/ Fyi, dns can be used to obtain public ip from large companies, without the overhead of tcp and http dig +short txt ch whoami.cloudflare @1.0.0.1 dig +short txt o-o.myaddr.l.google.com @ns1.google.com dig +short myip.opendns.com @resolver1.opendns.com

KomoD 3y ago
What does the "ch" mean?

Mandatum 3y ago

That’s typically why it’s a good idea to include a crappy “generate API” key button so you can block traffic like this, you don’t even need a registration process - someone can just email with reference to their API key to discuss their issues.

usrbinbash 3y ago
> you don’t even need a registration process You should put it behind a CAPTCHA of some sort however, otherwise, some smartass will just write a "library" auto-fetching an api key as soon as the one it has currently cached stops working. And yes, that is an annoyance to users, but so what? Please direct all complaints to the comparatively small number of people responsible for the fact that the rest of us cannot have nice things.
- Etheryte 3y ago
  This is not really a problem, you can easily disable generating new keys and sidestep the problem. Everyone who's legit can keep using their old keys.
- ransackdev 3y ago
  CAPTCHA is for humans while this json service is for machines

n0n0n4t0r 3y ago

Wikipedia had a similar situation with a single flower image being requested so many times. I can't find the story and don't remember it well, but I think it was a big indian company using this image to check if internet was available. IMHO, one of the problems is that many dev. don't realize both the size of their company and the impact of so many requests. I hop you'll find a solution, and thank you for your service! PS: maybe you should create a dedicated post about this subject to attract visibility

parekhnish 3y ago
Oh yes! I remember that! [1]: Wikimedia Phabricator link: https://phabricator.wikimedia.org/T273741 https://phabricator.wikimedia.org/T273741 [2]: HackerNews thread: https://news.ycombinator.com/item?id=26072025 https://news.ycombinator.com/item?id=26072025

danpalmer 3y ago

> However Cloudflare doesn't properly ... Despite numerous support requests, that's still shmaybe an enterprise level feature. This matches my experience. I'd use the CF free plan assuming no guarantees for a low risk site like my personal site, and I'd use the expensive enterprise plan where I'm paying individually for features and quota, but I'd never use the middle-ground "sure it's unlimited!" plan – it's far too vague about what it _actually_ provides.

TallGuyShort 3y ago
Ironically, "sure it's unlimited" is now a thing the parent comment has probably learned not to say too.

megablast 3y ago

> literally fucking killing me Wow, that's crazy.

netsharc 3y ago

> You're literally fucking killing me. Literally being killed? Call the police!!!11

ransackdev 3y ago

> That kind of increase in traffic costs me money I've never had to plan for. https://getjsonip.com/#plus https://getjsonip.com/#plus Going further with jsonip Plus With the upcoming Plus service, you get special features and even more information about your users. - All of the free service features - IP geo location - Country and city to within best available accuracy - ISP Info - Time zone data - Full referer data - Browser and OS info https://web.archive.org/web/20200811215649/https://getjsonip.com/#plus https://web.archive.org/web/20200811215649/https://getjsonip... A paid service has been "upcoming" since at least August 2020, which would subsidize the free tier usage you allow on your site. Aside from the ISP and geo data, everything else is given to you in the request headers or can be determined with the ip address (geo can get tz). If it's costing you money, shipping the Plus features might offset your out of pocket expenses. This is a failure of growth/capacity planning and lack of a proper TOS that clarifies "unlimited within reason and at our sole discretion with no SLA or warranty of any kind for non-paying users", as well as failure to ship any monetizing features 3 years after announcing it. Contacting them to have them stop wouldn't solve your problems. What happens when the next million devices get random updates from literally anybody that starts doing it again? Try to implement rate limiting, optimize your hot code paths, watch out for slow clients (buffered reverse proxies), needless header parsing, slow template rendering, etc. Any language capable of concurrency should be able to handle 100s of thousands of requests on a cheap vm. The client ip is coming to you in the request headers and all you do is print it back to them... A go handler would be a few lines of code to do this and that's including dealing with reverse proxy real-ip type stuff. You don't need to allocate an actual struct and serialize into a json object, just printf a hardcoded string with a replacement for the ip from the header, or better yet benchmark the fastest solution. I'll do it for you, I'm looking for a job ;)

deleted 3y ago
[deleted]
manfre 3y ago
You assumed the issue relates only to compute costs. Even with a small payload, bandwidth fees can add up quickly when millions of clients are polling.

timbuchwaldt 3y ago

We see your exact Dalvik problem on deepl.com as well. We get a constant flood of those requests, sometimes subsiding. They are globally distributed, preliminary in lower-income countries. We have tried lots of things, like letting them just time out, returning different errors, redirecting of many sorts including Android intents, no solution. They now made it to our permanent blocklist and we just deal with the useless additional traffic. We are still hyper curious what on earth is loading us and for what reason though. AFAIK we couldn't see translation requests from them, just loading our website.

ransackdev 3y ago
Welcome to the internet. Install pfsense/opnsense and run your own firewall at home and you'll be shocked at the flood of non-stop portscans hitting your ip getting blocked. This is par for the course and there is nothing you can do to prevent it, you have to build systems able to mitigate, offload, block bad actors. This will always be the case. Any free service that has utility will be quickly scripted against and used to make someone else money. Build accordingly
ransackdev 3y ago
You mentioned low income countries. This could be infected devices running ancient unpatched OSes, but what if the traffic is legit, coming from impoverished countries who found your service and use it to teach their children and learn things they'd otherwise not have access to? Personally I would deep dive the traffic and try to determine the intent behind it, you could be destroying a future generation's potential, and not blocking malware I'm assuming you can correlate the requests from those ips with that they are translating. Odds are someone is hitting your service to translate for their paid service, but if it's an important part of a poor country, I'd find a way to allow it to keep happening > AFAIK we couldn't see translation requests from them, just loading our website. Browser homepage? Or maybe the unlucky victim of a "connectivity check/am I online" recurring task
geuis 3y ago
That's interesting. The traffic sources hitting me seem to be the opposite. Mainly US, Western Europe, and other better well to do places around the world. I suspect a lot of the traffic is from apps on smart devices. I've seen user agents that reference Bravia tvs for example.

RobotToaster 3y ago

I hate to add to your headache, but multiple pihole ad blacklists contain your domain. It looks like https://winhelp2002.mvps.org/ https://winhelp2002.mvps.org/ may be the original source of the blacklisting.

ransackdev 3y ago
pihole and other dns blocklists would reduce traffic to their service, not increase it
- nickjj 3y ago
  Yeah but it means their service is less valuable. If adblockers block traffic to that domain then there's less incentive to pay for the service because an undetermined but ever growing percentage of traffic will block it. Now it's a headache for a different reason.
News-Dog 3y ago
hosts file (modified) sourced from; Steven-Black - hosts @GitHub : https://github.com/StevenBlack/hosts https://github.com/StevenBlack/hosts cat /etc/hosts |grep -i 'jsonip.com' 0.0.0.0 jsonip.com 0.0.0.0 www.jsonip.com

jgrahamc 3y ago

I’d love to know more about “However Cloudflare doesn't properly route ipv4 address because "ipv6 is cool so we only do that" or something. Despite numerous support requests, that's still shmaybe an enterprise level feature.” jgc@cloudflare.com if you can share your interactions with us.

ransackdev 3y ago

Couple things to consider 1. Check your competitors who return json and see if they have a Location header 301'ing or 302'ing all their traffic to your service (if the client follows redirects). 2. Reverse dns lookup your origin ips and see if anyone has a domain's dns pointed at your service. Check the Host header on your end and make sure it's your domain as well as ensure your web server and/or proxy are not blindly accepting traffic for `*`/any host, and make sure it's serving only your host 3. Ip address headers can be spoofed. It might not be coming from where you think it's coming from