2016-05-01

• Since yesterday there have been 10,000 REST errors and the site has been unstable again
• I have blocked access to the API now
• There are 3,000 IPs accessing the REST API in a 24-hour period!

# awk '{print $1}' /var/log/nginx/rest.log  | uniq | wc -l
3168

• The two most often requesters are in Ethiopia and Colombia: 213.55.99.121 and 181.118.144.29
• 100% of the requests coming from Ethiopia are like this and result in an HTTP 500:

GET /rest/handle/10568/NaN?expand=parentCommunityList,metadata HTTP/1.1

• For now I’ll block just the Ethiopian IP