Spam providing from internal IP addresses as 172.17.0.1?

[pfaffman (Jay Pfaffman)]

@Thanatermesis

As we can see in the first screenshot, it seems like only some ones (looks like only from spambots)

Sorry. Once I saw the 172.17.x.x addresses I assumed that you had a reverse proxy.

@Thanatermesis

Seems like im not using a reverse proxy, discourse is being served just from a docker instance, but no other “host” nginx process is running on that server.

So this is a standard install?

If you’ve got a single host and no load balancer/reverse proxy, then I don’t know how anyone would have such an IP address. Maybe something else is somehow forwarding traffic? Those are private addresses, so it would appear that they are coming from your local network. That suggests that the spam bot is living on your network. (Guide to Private IP Address Classes and Ranges - Ipstack)

If you don’t have legitimate users (e.g., people on your LAN) accessing Discourse from that IP range, you’re safe to block it. I’d contact someone who runs your network and let them know that these attacks are coming from those internal addresses..