2026-09-10 - Update on Recent Outages

cross-posted from: https://sh.itjust.works/post/66524166

Good day SJW community,

I wanted to provide everyone with an update regarding the stability issues we experienced over the past 24 hours.

Beginning Wednesday, September 9, we observed a significant spike in incoming requests originating from a large number of IP addresses associated with networks operated by Baidu, Tencent and OneCable Network LLC.

The traffic patterns pointed to coordinated web scraping activity distributed across large IP ranges. This approach allowed the scrapers to circumvent the per-IP rate limits we have in place by spreading requests across many different addresses. The requests were primarily targeting comments and post content, suggesting the activity was focused on large-scale data collection, potentially for AI model-related purposes.

We identified this activity by analyzing traffic patterns at the Autonomous System Number (ASN) level and reviewing the average number of requests per minute generated by each network.

At the same time, we identified a separate source of abnormal traffic that appeared to be coming from another actor. These requests were performing expensive search queries that placed significant load on the server and affected its ability to respond to legitimate requests in a timely manner.

This traffic was using the following user agent:

NexusGlobalBot/2.0 (SupabaseEdgeRuntime/1.76.0)

After blocking this agent and its associated request patterns, we observed a significant reduction in server load, bringing utilization much closer to normal operating levels.

This is not the first time we have encountered this type of activity over the past several months and unfortunately, it is unlikely to be the last. We will continue improving our monitoring, rate limiting, and mitigation measures to reduce the impact of abusive or excessive automated traffic while maintaining reliable access for legitimate users.

Thank you for your continued support and trust.

55 points · 7 comments · view on lemmy.world

7 Comments

velma@sh.itjust.works · 15 pts · 2d

Thank you for your work!!

verity_kindle@sh.itjust.works · 11 pts · 2d

Thanks for the detailed heads up. Sorry you have to deal with this crap. TheDude for Premier?

scottmeme@sh.itjust.works · 8 pts · 2d

Appreciate all the work you do dude!

nkat2112@sh.itjust.works · 8 pts · 2d

Thank you, Dude, for all that you do for us! We appreciate you!

sedawk@sh.itjust.works · 3 pts · 2d (1 reply)

Question: Yesterday (sept 9th), I was unable to load this lemmy instance using Voyager on Android. (Other lemmy instances continued to work). Could this have have been caused by this? I could load from Chrome browser, but not from the Android app.

The android app appears to have returned to normal working behavior now.


Answering my own question -- apparently the answer is yes -- from another post https://sh.itjust.works/post/66506764/27347000.

TheDude@sh.itjust.works · 10 pts · 2d

Great question and I’m happy to provide some clarity.

When the server comes under significant load from this type of coordinated scraping activity, it becomes extremely difficult to investigate the issue while it is happening. Even with out-of-band access, the server can become so overloaded that it is nearly unresponsive.

To relieve some of that pressure, I temporarily enable Cloudflare’s Under Attack Mode. This helps reduce the amount of traffic reaching the server, but it also interfere with certain third-party applications, such as Voyager and others.

I enable Under Attack Mode to reduce the load and collect access logs showing what the filtered traffic looks like. I then disable it temporarily to capture additional traffic, including requests that were previously being blocked. This is why you may intermittently regain access during these incidents.

By comparing these two datasets, I can more quickly distinguish legitimate traffic from malicious or unwanted traffic patterns. From there, I can adjust the security rules to make it more difficult and costly for that bad traffic to reach the server in the first place.

Sorry if that got a little technical.

RestrictedAccount@lemmy.world · 0 pts · 2d