<![CDATA[I see quite a lot of webfinger requests to my ActivityPub server with the User Agent set to "Identity Collector/3.0.0 (+local defensive OSINT collector)".]]>I see quite a lot of webfinger requests to my ActivityPub server with the User Agent set to "Identity Collector/3.0.0 (+local defensive OSINT collector)".

Anyone knows what that is about?

]]>https://bb.devnull.land/topic/5ed4396f-fdef-40b1-ab23-aa01fe2c1065/i-see-quite-a-lot-of-webfinger-requests-to-my-activitypub-server-with-the-user-agent-set-to-identity-collector-3.0.0-local-defensive-osint-collector-.RSS for NodeSun, 13 Sep 2026 02:00:30 GMTThu, 10 Sep 2026 07:48:11 GMT60<![CDATA[Reply to I see quite a lot of webfinger requests to my ActivityPub server with the User Agent set to "Identity Collector/3.0.0 (+local defensive OSINT collector)". on Fri, 11 Sep 2026 09:54:24 GMT]]>In theory I would approve of scanning instances for systematic impersonation of well-known users.

But re-checking the same username repeatedly during the day seems a bit overeager.

]]>https://bb.devnull.land/post/https://fosstodon.org/users/pmakholm/statuses/117251798732870936https://bb.devnull.land/post/https://fosstodon.org/users/pmakholm/statuses/117251798732870936Fri, 11 Sep 2026 09:54:24 GMT<![CDATA[Reply to I see quite a lot of webfinger requests to my ActivityPub server with the User Agent set to "Identity Collector/3.0.0 (+local defensive OSINT collector)". on Thu, 10 Sep 2026 13:16:18 GMT]]>@pmakholm I grepped my logs for OSINT and saw this one from 38.242.221.77 "Mastodon/4.7.1 (http.rb/5.3.1; +https://osintua.eu/) Bot"

"This server is hosted by OSINTukraine.com, its purpose is to host a set of bots auto-sharing DeepL translated post from the Russian and Ukrainian Telegram ecosystems."

]]>https://bb.devnull.land/post/https://social.alexschroeder.ch/users/alex/statuses/01M25QCH510Z6BTS1PH1WTWG25https://bb.devnull.land/post/https://social.alexschroeder.ch/users/alex/statuses/01M25QCH510Z6BTS1PH1WTWG25Thu, 10 Sep 2026 13:16:18 GMT<![CDATA[Reply to I see quite a lot of webfinger requests to my ActivityPub server with the User Agent set to "Identity Collector/3.0.0 (+local defensive OSINT collector)". on Thu, 10 Sep 2026 09:25:22 GMT]]>@Steve_Bate Seems to be dynamic IP from a single ISP.

Some of the accounts is is requesting is well known names like torvalds, gvanrossum, and dhh. Others are just ben and jess and then some seemingly random id based.

]]>https://bb.devnull.land/post/https://fosstodon.org/users/pmakholm/statuses/117246022290453433https://bb.devnull.land/post/https://fosstodon.org/users/pmakholm/statuses/117246022290453433Thu, 10 Sep 2026 09:25:22 GMT<![CDATA[Reply to I see quite a lot of webfinger requests to my ActivityPub server with the User Agent set to "Identity Collector/3.0.0 (+local defensive OSINT collector)". on Thu, 10 Sep 2026 08:56:52 GMT]]>@pmakholm Interesting. Any hints from the client IP addresses? One address, many, using proxies, etc.?

]]>https://bb.devnull.land/post/https://mastodon.social/ap/users/117032591268870234/statuses/117245910235245625https://bb.devnull.land/post/https://mastodon.social/ap/users/117032591268870234/statuses/117245910235245625Thu, 10 Sep 2026 08:56:52 GMT