<div dir="auto"><div>Ha! Don't block 'em. Set up a forwarding proxy with a "permanently moved" and send them all back to facebook addresses. 🖕</div><div><br></div><div data-smartmail="gmail_signature"><div dir="ltr">-- <br>James P. Kinney III<br><i><i><i><i><br></i></i></i></i>Every time you stop a school, you will have to build a jail. What you
gain at one end you lose at the other. It's like feeding a dog on his
own tail. It won't fatten the dog.<br>
- Speech 11/23/1900 Mark Twain<br><i><i><i><i><br><a href="http://heretothereideas.blogspot.com/" target="_blank">http://heretothereideas.blogspot.com/</a><br></i></i></i></i></div></div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Sun, Apr 5, 2026, 2:52 PM lollipopman691 via Ale <<a href="mailto:ale@ale.org">ale@ale.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">In recent days facebook's crawlers ( or someone impersonating them) have been hammering my website hard enough to bring it to its knees.<br>
The hits all seem to originate from addresses in <a href="http://57.141.0.0/32" rel="noreferrer noreferrer" target="_blank">57.141.0.0/32</a>, which <a href="http://iplocation.net" rel="noreferrer noreferrer" target="_blank">iplocation.net</a> puts in Ashburn,VA and owned by facebook//meta.<br>
<br>
Here's an example of a hit from /var/log/apache2/other_vhosts_access.log:<br>
<br>
<a href="http://tomshiro.org:443" rel="noreferrer noreferrer" target="_blank">tomshiro.org:443</a> 57.141.0.50 - - [05/Apr/2026:14:26:23 -0400] "GET /foswiki/bin/edit/System/WebSearch?t=1775413530 HTTP/1.1" 504 2571 "-" "meta-webindexer/1.1 (+<a href="https://developers.facebook.com/docs/sharing/webmasters/crawler" rel="noreferrer noreferrer" target="_blank">https://developers.facebook.com/docs/sharing/webmasters/crawler</a>)"<br>
<br>
I am getting a *massive* number of these. My (crude) weblog analyzer lists 9515 of them between midnight and 2 pm, many of them in bursts less than a second apart.<br>
<br>
So I have attempted to ban that ip address through ufw, using the command "ufw deny from <a href="http://57.141.0.0/32" rel="noreferrer noreferrer" target="_blank">57.141.0.0/32</a>" . Here's the output from "ufw status numbered:<br>
<br>
Status: active<br>
<br>
To Action From<br>
-- ------ ----<br>
[ 1] 25/tcp ALLOW IN Anywhere<br>
[ 2] 22/tcp ALLOW IN Anywhere<br>
[ 3] Anywhere DENY IN <a href="http://146.174.0.0/16" rel="noreferrer noreferrer" target="_blank">146.174.0.0/16</a><br>
[ 4] Anywhere DENY IN <a href="http://185.171.0.0/16" rel="noreferrer noreferrer" target="_blank">185.171.0.0/16</a><br>
[ 5] Anywhere DENY IN 20.171.207.109<br>
[ 6] Anywhere DENY IN <a href="http://202.76.0.0/16" rel="noreferrer noreferrer" target="_blank">202.76.0.0/16</a><br>
[ 7] Anywhere DENY IN <a href="http://212.52.0.0/16" rel="noreferrer noreferrer" target="_blank">212.52.0.0/16</a><br>
[ 8] Anywhere DENY IN 216.73.216.125<br>
[ 9] Anywhere DENY IN <a href="http://47.238.0.0/16" rel="noreferrer noreferrer" target="_blank">47.238.0.0/16</a><br>
[10] Anywhere DENY IN <a href="http://47.239.0.0/16" rel="noreferrer noreferrer" target="_blank">47.239.0.0/16</a><br>
[11] Anywhere DENY IN <a href="http://47.242.0.0/16" rel="noreferrer noreferrer" target="_blank">47.242.0.0/16</a><br>
[12] Anywhere DENY IN <a href="http://47.243.0.0/16" rel="noreferrer noreferrer" target="_blank">47.243.0.0/16</a><br>
[13] Anywhere DENY IN <a href="http://47.76.0.0/16" rel="noreferrer noreferrer" target="_blank">47.76.0.0/16</a><br>
[14] Anywhere DENY IN <a href="http://8.210.0.0/16" rel="noreferrer noreferrer" target="_blank">8.210.0.0/16</a><br>
[15] Anywhere DENY IN <a href="http://8.218.0.0/16" rel="noreferrer noreferrer" target="_blank">8.218.0.0/16</a><br>
[16] Anywhere DENY IN 45.206.0.0<br>
[17] Anywhere DENY IN 47.128.0.0<br>
[18] Anywhere DENY IN 57.141.0.0<br>
[19] 80 (v6) ALLOW IN Anywhere (v6)<br>
[20] 443 (v6) ALLOW IN Anywhere (v6)<br>
[21] 25/tcp (v6) ALLOW IN Anywhere (v6)<br>
[22] 22/tcp (v6) ALLOW IN Anywhere (v6)<br>
<br>
<br>
<br>
You can see the ban rule in line 18, above. <br>
<br>
Theoretically this should stop these hits, yes? Or should I be saying "ufw deny from <a href="http://57.141.0.0/16" rel="noreferrer noreferrer" target="_blank">57.141.0.0/16</a>" ?<br>
<br>
This is on a pretty much stock Debian 12 server running on aws ec2, FWIW.<br>
<br>
-- CHS<br>
<br>
<br>
<br>
<br>
_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org" target="_blank" rel="noreferrer">Ale@ale.org</a><br>
<a href="https://mail.ale.org/mailman/listinfo/ale" rel="noreferrer noreferrer" target="_blank">https://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" rel="noreferrer noreferrer" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
</blockquote></div>