Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • World
  • Users
  • Groups
Skins
  • Light
  • Brite
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse

NodeBB

  1. Home
  2. Technical Discussion
  3. I see quite a lot of webfinger requests to my ActivityPub server with the User Agent set to "Identity Collector/3.0.0 (+local defensive OSINT collector)".

I see quite a lot of webfinger requests to my ActivityPub server with the User Agent set to "Identity Collector/3.0.0 (+local defensive OSINT collector)".

Scheduled Pinned Locked Moved Technical Discussion
activitypubwebfinger
1 Cross-posts 5 Posts 3 Posters 1 Views
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • pmakholm@fosstodon.orgP
    pmakholm@fosstodon.orgP
    pmakholm@fosstodon.org
    wrote last edited by
    #1

    I see quite a lot of webfinger requests to my ActivityPub server with the User Agent set to "Identity Collector/3.0.0 (+local defensive OSINT collector)".

    Anyone knows what that is about?

    #ActivityPub #webfinger

    steve_bate@mastodon.socialS alex@social.alexschroeder.chA pmakholm@fosstodon.orgP 3 Replies Last reply
    0
    • pmakholm@fosstodon.orgP pmakholm@fosstodon.org

      I see quite a lot of webfinger requests to my ActivityPub server with the User Agent set to "Identity Collector/3.0.0 (+local defensive OSINT collector)".

      Anyone knows what that is about?

      #ActivityPub #webfinger

      steve_bate@mastodon.socialS
      steve_bate@mastodon.socialS
      steve_bate@mastodon.social
      wrote last edited by
      #2

      @pmakholm Interesting. Any hints from the client IP addresses? One address, many, using proxies, etc.?

      1 Reply Last reply
      0
      • steve_bate@mastodon.socialS steve_bate@mastodon.social

        @pmakholm Interesting. Any hints from the client IP addresses? One address, many, using proxies, etc.?

        pmakholm@fosstodon.orgP
        pmakholm@fosstodon.orgP
        pmakholm@fosstodon.org
        wrote last edited by
        #3

        @Steve_Bate Seems to be dynamic IP from a single ISP.

        Some of the accounts is is requesting is well known names like torvalds, gvanrossum, and dhh. Others are just ben and jess and then some seemingly random id based.

        1 Reply Last reply
        0
        • pmakholm@fosstodon.orgP pmakholm@fosstodon.org

          I see quite a lot of webfinger requests to my ActivityPub server with the User Agent set to "Identity Collector/3.0.0 (+local defensive OSINT collector)".

          Anyone knows what that is about?

          #ActivityPub #webfinger

          alex@social.alexschroeder.chA
          alex@social.alexschroeder.chA
          alex@social.alexschroeder.ch
          wrote last edited by
          #4

          @pmakholm I grepped my logs for OSINT and saw this one from 38.242.221.77 "Mastodon/4.7.1 (http.rb/5.3.1; +https://osintua.eu/) Bot"

          "This server is hosted by OSINTukraine.com, its purpose is to host a set of bots auto-sharing DeepL translated post from the Russian and Ukrainian Telegram ecosystems."

          1 Reply Last reply
          0
          • pmakholm@fosstodon.orgP pmakholm@fosstodon.org

            I see quite a lot of webfinger requests to my ActivityPub server with the User Agent set to "Identity Collector/3.0.0 (+local defensive OSINT collector)".

            Anyone knows what that is about?

            #ActivityPub #webfinger

            pmakholm@fosstodon.orgP
            pmakholm@fosstodon.orgP
            pmakholm@fosstodon.org
            wrote last edited by
            #5

            In theory I would approve of scanning instances for systematic impersonation of well-known users.

            But re-checking the same username repeatedly during the day seems a bit overeager.

            1 Reply Last reply
            0
            • ? [[global:guest]] crossposted this topic to General Discussion

            Hello! It looks like you're interested in this conversation, but you don't have an account yet.

            Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.

            With your input, this post could be even better 💗

            Register Login
            Reply
            • Reply as topic
            Log in to reply
            • Oldest to Newest
            • Newest to Oldest
            • Most Votes


            • Login

            • Don't have an account? Register

            • Login or register to search.
            Powered by NodeBB Contributors
            • First post
              Last post
            0
            • Categories
            • Recent
            • Tags
            • Popular
            • World
            • Users
            • Groups