x.x.x.x - - [10/Nov/2024:00:02:37 +0000] "GET / HTTP/1.1" 301 162 "-" "okhttp/4.9.0"
You know what’s interesting about this log line? It repeats 56,686,963 times in www.kernel.org logs for yesterday, across 4 nodes. That’s about 700 times a second, and this has been going on for months.
These requests aren’t intentionally malicious – they issue a simple GET /, receive their 301 redirect, and terminate the connection. From what I can tell, this is some kind of appliance or software installed on mobile clients that uses “can I reach www.kernel.org” as a network test.
This wouldn’t be that big of a deal – a single plaintext “GET /“ that triggers an immediate 301 is very cheap for us to generate, but the number of these requests has been steadily growing.
If you have any idea what this is and how to make it stop, please reach out?
K. Ryabitsev /
npub1jf…fs8ga
2024-11-12 21:30:42
Author Public Key
npub1jfdhtm0dgcfuv46jrqz9u2caskuj5lglwwpns2mlv4eppvkna8uq6fs8gaPublished at
2024-11-12 21:30:42Event JSON
{
"id": "e2eb4d6cb1e1614d4b3f90433f51fc3c05a5e8af82cb20a88513da28c91572e9",
"pubkey": "925b75eded4613c6575218045e2b1d85b92a7d1f7383382b7f657210b2d3e9f8",
"created_at": 1731447042,
"kind": 1,
"tags": [
[
"proxy",
"https://social.kernel.org/objects/b3edb7d1-1952-4374-b1a4-9ab5c63e99b3",
"activitypub"
]
],
"content": "x.x.x.x - - [10/Nov/2024:00:02:37 +0000] \"GET / HTTP/1.1\" 301 162 \"-\" \"okhttp/4.9.0\"\n\nYou know what’s interesting about this log line? It repeats 56,686,963 times in www.kernel.org logs for yesterday, across 4 nodes. That’s about 700 times a second, and this has been going on for months.\n\nThese requests aren’t intentionally malicious – they issue a simple GET /, receive their 301 redirect, and terminate the connection. From what I can tell, this is some kind of appliance or software installed on mobile clients that uses “can I reach www.kernel.org” as a network test.\n\nThis wouldn’t be that big of a deal – a single plaintext “GET /“ that triggers an immediate 301 is very cheap for us to generate, but the number of these requests has been steadily growing.\n\nIf you have any idea what this is and how to make it stop, please reach out?",
"sig": "9ee1423d1b43c0f9d636daaf3f545cc4b99d4ecde05d6ac9e60c44218f8c70964aea701520119c15e251cfb04bfddeb4cf1059e296804bc8f9c0d0eba1029b1b"
}