[14:27:14] <RhinosF1>	 fyi, phab issue got am.ir pinged in -releng.
[16:23:07] <RhinosF1>	 Amir1, marostegui: bugreporter says issues again
[16:23:10] <RhinosF1>	 https://phabricator.wikimedia.org/T298369#7591276
[16:23:39] <marostegui>	 ok let me check
[16:25:03] <RhinosF1>	 marostegui: taavi says https://w.wiki/4caA shows a single UA making a lot of requests
[16:28:00] <marostegui>	 Yeah, looks like some spikes. Hard to know if it is not caught that very same moment
[16:28:30] <marostegui>	 I can check the binlogs if needed, but I am not seeing any super obvious time range for writes (reads aren't on binlogs)
[16:32:18] <marostegui>	 I have found a few weird queries
[16:36:15] <marostegui>	 just commented on the task with some queries I have seen
[16:45:50] <taavi>	 turnilo still shows a single IP address with a single browser UA that has ~1k phabricator hits per hour in the webrequests_sampled_128 dataset starting around 14:00 UTC
[17:24:18] <marostegui>	 taavi: so maybe that needs to be blocked 
[17:24:26] <marostegui>	 I don't think that can be something legit
[17:37:55] <taavi>	 marostegui: yeah, if it's still going I'd block it and see what happens
[17:39:05] <marostegui>	 taavi: if we've got an IP I would ask traffic to block it, if it is something legit they can contact us and see what is needed and how it can be done
[17:43:20] <taavi>	 I see an address, see _security
[19:29:07] <RhinosF1>	 marostegui: I can't load phab again
[19:29:33] <RhinosF1>	 It's really slow
[19:29:47] <marostegui>	 RhinosF1: the IP needs to be blocked, I cannot do much
[19:30:07] <RhinosF1>	 marostegui: have traffic been alerted
[19:31:07] <marostegui>	 RhinosF1: I have commented it on another channel, but I'm dealing with personal issues at the moment, I cannot follow up this topic.