Information about misusage of ip.bieringer.de

Issue

Since longer time (approx. over a year) ip.bieringer.de is misused on port 8080 in a continous way by a Java software from various IP addresses:

GET / HTTP/1.1
Host: ip.bieringer.de:8080
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.5.3 (Java/1.8.0_102)
Accept-Encoding: gzip,deflate

Mitigations

Several workarounds did not stop that misusage like:

respond since long time "HTTP 403" (blocked by detected user agent)
close down port 8080 for quite a while

Following step reduced the misusage a lot

return to DNS servers with following country codes 'NXDOMAIN' instead of the real IP address: VN

Leftover requestor is now:

103.125.189.140 - - [14/Nov/2020:16:35:35 +0100] "GET / HTTP/1.1" 403 209 "-" "Apache-HttpClient/4.5.3 (Java/1.8.0_102)" 8080 "ip.bieringer.de:8080" "-" 155 375 "-/-/-/-"

(must be something like a master control server...)

Workaround

In case of any issues with blocked DNS resolution replace in your browser: ip.bieringer.de -> ipng.bieringer.de

Note

If I detected that one change the FQDN to "ipng.bieringer.de" then I will get really angry and close down the service!

Request of help

If one has any hint about the root cause, please contact me - thank you very much!

2020-11-14, webmaster at bieringer dot de

Your connection is via: IPv4
Your address: 3.227.235.183

www.bieringer.de
is maintained by
webmaster at bieringer dot de
(Impressum)