Facebook is pounding our website with requests with spoofed User-Agents, and apparently some kind of sandboxed non-functional version of JavaScript, and it's generating hundreds of thousands of JavaScript error alerts in our monitoring software.
We use a product called Sentry.io to monitor and catch JavaScript errors that visitors to our website generate and use them to troubleshoot and fix the issue.
Over the past five days we've seen a marked increase in a couple of specific errors. The odd part is that for the hundreds of thousands of errors they're being generated from approximately 340 IP addresses and all of them belong to Facebook. I've searched all of them in Arin.net and all of them have the same owner. This many errors from this few IP's is very, very odd. Normally a high number of errors is from a high number of users -- and a clear sign of something wrong. This seems very different.
The user agents on these requests, however, are not Facebook bot UA's. None of them look like this:
facebookexternalhit/1.1
They look like some flavor of:
Mozilla/5.0 (iPhone; CPU iPhone OS 13_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 [FBAN/FBIOS;FBAV/274.0.0.57.114;FBBV/219493625;FBDV/iPhone10,4;FBMD/iPhone;FBSN/iOS;FBSV/13.5.1;FBSS/2;FBID/phone;FBLC/ko_KR;FBOP/5;FBRV/0]
Mozilla/5.0 (iPhone; CPU iPhone OS 13_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Mobile/15E148 Safari/604.1
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
I found this HackerNews article from 22 days ago where someone else was starting to see similar issues:
https://news.ycombinator.com/item?id=23490367
Has anyone else seen this issue and found a way to block this traffic, or resolve it? I'm about to block these IP's at the router -- but this feels like a bit of a game of whack-a-mole.