On 2026-02-03 07:35:46, ariel sabiguero yawelak wrote:
> Getting traffic right now:
>
> 74.7.243.197 - - [03/Feb/2026:07:27:59 -0300] "GET
> /merged/dists/testing/contrib/debian-installer/binary-amd64/by-hash/SHA256/59a3bf90cab125fef4afb3197d3b56c76526fb7b2bb0983d73aec538d2b0e5f6
> HTTP/1.1" 200 391
> 35.233.94.99 - - [03/Feb/2026:07:27:59 -0300] "GET
> /devuan/dists/stable/main/debian-installer/binary-armel/by-hash/SHA256/
> HTTP/1.1" 200 25139
> 74.7.227.48 - - [03/Feb/2026:07:27:59 -0300] "GET
> /merged/dists/testing-updates/non-free/binary-i386/by-hash/SHA256/6f727602a45ef2f4108cfc495ec03d6108685a372daaabe7f1fa5306c287cadd
> HTTP/1.1" 200 29
> 35.233.94.99 - - [03/Feb/2026:07:27:59 -0300] "GET
> /devuan/dists/stable/main/debian-installer/binary-armhf/ HTTP/1.1" 200
> 1072
> 35.233.94.99 - - [03/Feb/2026:07:28:00 -0300] "GET
> /devuan/dists/stable/main/debian-installer/binary-armhf/by-hash/
> HTTP/1.1" 200 867
> 74.7.227.48 - - [03/Feb/2026:07:28:00 -0300] "GET
> /merged/dists/testing-updates/non-free/binary-i386/by-hash/SHA256/cc6ffc1f78d18c3ab1e65a444f255f8be8c8c57aad553a2d452d84da592802b8
> HTTP/1.1" 200 29
> 74.7.243.197 - - [03/Feb/2026:07:27:59 -0300] "GET
> /merged/dists/testing/contrib/debian-installer/binary-amd64/by-hash/SHA256/4c486672026369b59f2ab075e96fa30608a5d96fa065e5dfacfa6efdded3f96f
> HTTP/1.1" 200 391
> 35.233.94.99 - - [03/Feb/2026:07:28:00 -0300] "GET
> /devuan/dists/stable/main/debian-installer/binary-armhf/by-hash/SHA256/
> HTTP/1.1" 200 26411
> 74.7.227.48 - - [03/Feb/2026:07:28:00 -0300] "GET
> /merged/dists/testing-updates/non-free/binary-i386/by-hash/SHA256/fe8d8d9de30464df58743aab7b2a6df0a1c05aa69676cb764eaf34f77e1c7545
> HTTP/1.1" 200 29
> 35.233.94.99 - - [03/Feb/2026:07:28:00 -0300] "GET
> /devuan/dists/stable/main/debian-installer/binary-i386/ HTTP/1.1" 200
> 1070
> 35.233.94.99 - - [03/Feb/2026:07:28:01 -0300] "GET
> /devuan/dists/stable/main/debian-installer/binary-i386/by-hash/
> HTTP/1.1" 200 861
> 74.7.243.197 - - [03/Feb/2026:07:28:00 -0300] "GET
> /merged/dists/testing/contrib/debian-installer/binary-amd64/by-hash/SHA256/3ee01ec5971930412f77d342c09e7cdb8fe6abd09049d1e0b7e90fdef3acbd73
> HTTP/1.1" 200 391
> 35.233.94.99 - - [03/Feb/2026:07:28:01 -0300] "GET
> /devuan/dists/stable/main/debian-installer/binary-i386/by-hash/SHA256/
> HTTP/1.1" 200 26408
> 74.7.227.48 - - [03/Feb/2026:07:28:01 -0300] "GET
> /merged/dists/testing-updates/non-free/binary-i386/by-hash/SHA256/19fec0cc35be2ce2dea8b6b2b91a195005e7e73de5746d8c1e8e1919a0010ad0
> HTTP/1.1" 200 29
> 74.7.243.197 - - [03/Feb/2026:07:28:01 -0300] "GET
> /devuan/dists/experimental/main/debian-installer/binary-amd64/by-hash/SHA256/25231f17952cac512b323279ba12d7e1949fc1c869e6e7a20348533ca9e5275c
> HTTP/1.1" 200 521
> 35.233.94.99 - - [03/Feb/2026:07:28:01 -0300] "GET
> /devuan/dists/stable/main/debian-installer/binary-ppc64el/ HTTP/1.1" 200
> 1076
That's all legit traffic.
> but if i grep -i "claudebot" I don't get a single entry.
Check for 404 errors. It's not just one bot.
> If you check what the bot is searching for, it seems a server exposing the
> root of the www server directory. In our case, if there was some
> misconfiguration, it should start with /zp0/mirrors/..... and not /pub
> (maybe it is the pub inside /srv/www folder).
>
> Seems that our end is working, I went for
> [1]http://uy.deb.devuan.org/tralala and it is
>
> espejito:/var/log/apache2 # cat deb.devuan.org_access_log | grep tralala
> 190.133.48.56 - - [03/Feb/2026:07:34:45 -0300] "GET /tralala HTTP/1.1"
> 404 1079
>
> correctly failing
>
> regards
>
> ariel
>
> El 3/2/26 a las 7:21, onefang escribió:
>
> Look for lots of 404 errors resulting from AI bots trying to download
> lots of things that are not Devuan from deb.devuan.org. An example from
> Apache is -
>
> 216.73.216.33 - - [01/Feb/2026:13:01:01 +0100] "GET /pub/mirrors/opensuse/update/leap/15.3/sle/s390x/nftables-0.9.8-150300.3.3.1.s390x.rpm HTTP/1.1" 404 496 "-" [2]"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@???)"
>
> ClaudeBot trying to get an RPM package from my non existant OpenSUSE
> mirror, in my non existant /pub/ directory. I have seen it and others
> trying to get all manner of packages from all manner of non Devuan
> package repos. And trying the same files up to 7000 times per day.
>
> 216.73.216.33 and others are now banned at my firewall. Seems to have
> helped, so far.
>
> On 2026-02-03 07:07:37, ariel sabiguero yawelak wrote:
>
> What should we look for? I don't see differences in the traffic patterns or
> number of hits. Anything that I can search for?
>
> We host many other mirrors, but "deb.devuan.org" only offers devuan content,
> as only:
>
> <Directory "/zp0/mirrors/devuan/devuan">
>
> is associated to that vhost, and other mirrors are siblings
> of /zp0/mirrors/devuan and are served under espejito.fder.edu.uy/XXXXX
>
>
> regards
>
>
> ariel
>
> El 3/2/26 a las 1:10, Derek escribió:
>
> I don't see any activity that looks like this on my mirror. I don't have anything non-Devuan on my mirror either. All I see is regular internet background noise.
>
> Regards,
> Derek
>
>
> On Monday, February 2nd, 2026 at 8:01 PM, onefang [3]<onefang_devuan@???> wrote:
>
>
> I have two questions for all of us package mirror admins.
>
> Have you also been seeing these AI bots scanning your deb.devuan.org
> Devuan mirror for lots and lots of non Devuan packages?
>
> Does your deb.devuan.org mirror have non Devuan things available at that
> address? Please don't do that, I think it's causing these attacks.
> Devuan mirrors should all be showing the exact same thing at
> deb.devuan.org, that's what they are for.
>
> On 2026-01-31 14:25:01, onefang wrote:
>
>
> On 2025-11-27 15:02:35, onefang wrote:
>
>
> ClaudeBot is currently doing something really stupid. It somehow has
> come to the conclusion that my Devuan mirror mirrors EVERYTHING!
>
> So it's probing my mirror looking for things like rpms, jars, npn, cpan
> packages, etc, and specifically looking in directories named after other
> operating systems or package collections. Even stuff I have never heard
> of. I certainly don't mirror any of it, only Devuan.
>
> And it's doing it stupidly. It obviously knows what to expect, since it
> keeps asking me for the actual packages and metadata files that would be
> there if I was mirroring that particular thing. For example failing to
> download several rpm files from a directory that is named after some rpm
> based distro. After the first failure, it should figure out I'm not
> mirroring that, give up. On top of that, these are mirrors it is
> probing, the word "mirror" is even in some of the paths, they should all
> be identical. If it already knows what to expect, it doesn't need to
> download it yet again.
>
> This may be going on with other mirrors, though some of them do mirror
> other things as well. All it's doing is wasting bandwidth and space for
> log files. Slowing everything down. And clogging up the AI with lots of
> duplicates of binary files.
>
> I have a theory.
>
> I'm only seeing this nonsense for deb.devuan.org, not sledjhamr.org.
>
> AI bots are scanning deb.devuan.org, and the country code versions, no
> idea how they handle a DNS-RR. One or more of our package mirrors is
> also hosting mirrors of Fedora, SUSE, and the dozen other mirrors my
> server doesn't host that the AI bots are scanning for. These other
> Devuan mirrors have those non Devuan things available from deb.devuan.org
> I guess, which is how the bots figured all that non Devuan stuff is
> at deb.devuan.org
>
> So the AIs just think that all of us Devuan packge mirrors have all of
> the things that the other package mirrors have. And end up scanning my
> server for non existent directories thousands of times per day, looking
> for identical files. That's how the bots know what to scan for, they
> found it at deb.devuan.org before.
>
> I wonder if other Devuan mirrors are seeing this? We should block off
> Fedora / SUSE / whatever mirrors and things from deb.devuan.org. Might
> still take ages for the AI bots to forget to look for these things.
::
Re: [devuan-mirrors] [DNG] Artifici…
