Was greeted this morning by monitoring notifying me of crashing web containers throughout the night.
Root cause: distributed /media_proxy flood where clients request the entire srcset attribute as a URL (%20 + ,%20https:/.../small%20...w). At peak: 23,298 unique IPs per 5 min + lots of 499/503.
Mitigated via CrowdSec trigger on Traefik logs (path-based): https://github.com/toot-community/platform/commit/183ddfff3b70c8bf4b168cda52f84e6e3bf942de
This detection logic should apply to any WAF, though.
FYI #MastoAdmin
Jorijn Schrijvershof
npub17z…t0cpk
2026-02-03 07:32:49 UTC
Author Public Key
npub17ze3pufug78z26uwfmgwwphj38lfr0fanala8qxxfz0g496u77hq5t0cpkSeen on
wss://relay.momostr.pinkPublished at
2026-02-03 07:32:49 UTCEvent JSON
{
"id": "cc2fa1f2c34d5fe529173ac05a421bfc0439b34edef5448b3385f8b8665e308b",
"pubkey": "f0b310f13c478e256b8e4ed0e706f289fe91bd3d9f7fd380c6489e8a975cf7ae",
"created_at": 1770103969,
"kind": 1,
"tags": [
[
"proxy",
"https://toot.community/@jorijn/116005533731877540",
"web"
],
[
"t",
"mastoadmin"
],
[
"proxy",
"https://toot.community/users/jorijn/statuses/116005533731877540",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://toot.community/users/jorijn/statuses/116005533731877540",
"pink.momostr"
],
[
"-"
]
],
"content": "Was greeted this morning by monitoring notifying me of crashing web containers throughout the night.\n\nRoot cause: distributed /media_proxy flood where clients request the entire srcset attribute as a URL (%20 + ,%20https:/.../small%20...w). At peak: 23,298 unique IPs per 5 min + lots of 499/503.\n\nMitigated via CrowdSec trigger on Traefik logs (path-based): https://github.com/toot-community/platform/commit/183ddfff3b70c8bf4b168cda52f84e6e3bf942de\n\nThis detection logic should apply to any WAF, though. \n\nFYI #MastoAdmin",
"sig": "0578720b83630b13d6acb52ec958245d33f189f4733eb4c6424fcd555136507b611d11f0cb54d97e95d5cae913316bbd75e627d4d1f28ef341775dd4e76d662d"
}