Short story: I recently had a massive Spam on my discourse installation after to change a text template for the “email confirmation” that seeemed to be wrong (from an old install?) that the url had something like url/authorize_email/ , In the end I needed to apply a full forum recovery 5 days older… …

If you check user IPs they are all from that address, right? You’re using a reverse proxy (something like nginx-proxy, perhaps), right? You need to add something like this to your app.yml after_bundle_exec: - replace: filename: /etc/nginx/conf.d/discourse.conf from: "types {" to: | …

As we can see in the first screenshot, it seems like only some ones (looks like only from spambots) Seems like im not using a reverse proxy, discourse is being served just from a docker instance, but no other “host” nginx process is running on that server.

[صورة] Thanatermesis: As we can see in the first screenshot, it seems like only some ones (looks like only from spambots) Sorry. Once I saw the 172.17.x.x addresses I assumed that you had a reverse proxy. [صورة] Thanatermesis: Seems like im not using a reverse proxy, discourse is being s…

That is a docker/container IP, isn’t it?

That’s where I’ve seen it, but I think there are other uses for that range. Or maybe the spam bot is a docker container on that machine. :person_shrugging:

Well, I don’t know anything and for me docker world is one huge mystery, but I was thinking is it possibile to get container IP via SSH or something?

[صورة] pfaffman: So this is a standard install ? Yes, I did it many years ago but I recall to be this one. Basically: a dedicated small host machine on vultr (like those dropplets on DO) for only this purpose, installed on docker, the rest of the host/vps is not used for anything else. [صو…

Have you not updated your os in those many years? Could the host machine have been hacked? Those ip addresses look like they are coming from the same machine.

I plan to do a reinstall in 2-3 months [صورة] pfaffman: Could the host machine have been hacked? it doesn’t looks like but, this can be hard to know, on the other side the spambots are not massive (but it was massive a few days ago, for some reason I got massive spam 2 hours after changing t…

The strange thing is that this email template seems to be duplicated in my settings, so I created another post topic for this issue: [صورة] Duplicated email templates with wrong contents Support Is normal that I have duplicated templates in the email settings?…

بريد مزعج مقدم من عناوين IP داخلية مثل 172.17.0.1؟

الدعم

Thanatermesis (Elive Linux) 25 سبتمبر 2025، 3:21م 11

الشيء الغريب هو أن قالب البريد الإلكتروني هذا يبدو مكررًا في إعداداتي، لذلك أنشأت موضوعًا آخر لهذه المشكلة:

الموضوع		الردود	مرات العرض
Discourse shows server IP/localhost as user's IP Self-hosting unsupported-install	19	2152	12 يوليو 2022
IP addresses are not correct in my installation Support	8	1224	3 ديسمبر 2021
Remote users IPV6 address shows as localhost Support	30	4932	13 سبتمبر 2020
Spam Filter / Whitelist suggestions Self-hosting hosting	3	1801	15 أكتوبر 2016
User overview: Last IP Adress 172.17.0.1 Support	4	149	5 أبريل 2025

بريد مزعج مقدم من عناوين IP داخلية مثل 172.17.0.1؟

الموضوعات ذات الصلة