[GH-ISSUE #701] Healthcheck sent on new creation? #502

Closed
opened 2026-02-25 23:42:41 +03:00 by kerem · 6 comments
Owner

Originally created by @DarrenPIngram on GitHub (Sep 1, 2022).
Original GitHub issue: https://github.com/healthchecks/healthchecks/issues/701

Self-hosted instance, latest version via Docker.

I just set up a brand new HC alert/monitor. Went to document it and when I came back a few minutes later to close the tab, I saw there had been traffic immediately from IPs I do not recognise.

I accept people may randomly scan URLs, but the chances of this happening to a quiet HC instance on a sub-domain, guessing the "right" URL and within minutes of creation?

Is there by chance some "auto health check" made by yourselves, even with self-hosted instances, that I am not aware of (or missed in any documentation)?

The stranger thing (looking at other entries) is that this does not happen all of the time.

1x
52.89.103.*** Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/600.3.18 (KHTML, like Gecko) Version/8.0.3 Safari/600.3.18

2x
34.217.253.*** Mozilla/5.0 (compatible; DashLinkPreviews/5.1;)

1x
34.217.253*** Mozilla/5.0 (Macintosh; I

Originally created by @DarrenPIngram on GitHub (Sep 1, 2022). Original GitHub issue: https://github.com/healthchecks/healthchecks/issues/701 Self-hosted instance, latest version via Docker. I just set up a brand new HC alert/monitor. Went to document it and when I came back a few minutes later to close the tab, I saw there had been traffic immediately from IPs I do not recognise. I accept people may randomly scan URLs, but the chances of this happening to a quiet HC instance on a sub-domain, guessing the "right" URL and within minutes of creation? Is there by chance some "auto health check" made by yourselves, even with self-hosted instances, that I am not aware of (or missed in any documentation)? The stranger thing (looking at other entries) is that this does not happen all of the time. 1x 52.89.103.*** Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_2) AppleWebKit/600.3.18 (KHTML, like Gecko) Version/8.0.3 Safari/600.3.18 2x 34.217.253.*** Mozilla/5.0 (compatible; DashLinkPreviews/5.1;) 1x 34.217.253*** Mozilla/5.0 (Macintosh; I
kerem closed this issue 2026-02-25 23:42:41 +03:00
Author
Owner

@phaer commented on GitHub (Sep 1, 2022):

Browser often check links for either "safe-browsing" and/or local preview rendering, a user agent such as DashLinkPreviews does sound like the latter, no?
I think it's best to assume that any HTTP endpoint not requiring authentication will be hit by random traffic sooner or later, in a mostly unpredictable matter.

<!-- gh-comment-id:1233904006 --> @phaer commented on GitHub (Sep 1, 2022): Browser often check links for either "safe-browsing" and/or local preview rendering, a user agent such as `DashLinkPreviews` does sound like the latter, no? I think it's best to assume that any HTTP endpoint not requiring authentication will be hit by random traffic sooner or later, in a mostly unpredictable matter.
Author
Owner

@cuu508 commented on GitHub (Sep 1, 2022):

Is there by chance some "auto health check" made by yourselves, even with self-hosted instances, that I am not aware of

No, there isn't, at least not in the code in this repository, or the official Docker images.

My guess: one or more tools you are using is automatically scanning all URLs it sees for malware and/or to generate link preview images.

<!-- gh-comment-id:1233904103 --> @cuu508 commented on GitHub (Sep 1, 2022): > Is there by chance some "auto health check" made by yourselves, even with self-hosted instances, that I am not aware of No, there isn't, at least not in the code in this repository, or the official Docker images. My guess: one or more tools you are using is automatically scanning all URLs it sees for malware and/or to generate link preview images.
Author
Owner

@cuu508 commented on GitHub (Sep 1, 2022):

PS. In the past people have reported spurious pings when pasting ping URLs in Slack channel. To work around this, you can configure the check to require HTTP POST instead of HTTP GET requests. The scanners don't seem to go as far as to make HTTP POST requests :-)

<!-- gh-comment-id:1233906354 --> @cuu508 commented on GitHub (Sep 1, 2022): PS. In the past people have reported spurious pings when pasting ping URLs in Slack channel. To work around this, you can configure the check to require HTTP POST instead of HTTP GET requests. The scanners don't seem to go as far as to make HTTP POST requests :-)
Author
Owner

@DarrenPIngram commented on GitHub (Sep 1, 2022):

Thank you for the very prompt response, information and solution which we
will apply.

It is strange as the web was only used for setting up the monitor and I
fired the script via a command line. I get that stuff is scanned but it
seemed very coincidental to happen so quickly!

Anyway, we will go forward with your suggestion.

May I just ask a final question rather than opening a new ticket?

On your hosted service the /log endpoint exists in a URL. It does not seem
to be on my self-hosted instance. I see nothing in the docs to suggest I
need to set it up. Should it be there, or is that a unique feature to your
hosted version?

On Thu, 1 Sept 2022 at 11:06, Paul Haerle @.***> wrote:

Browser often check links for either "safe-browsing" and/or local preview
rendering, a user agent such as DashLinkPreviews does sound like the
latter, no?
I think it's best to assume that any HTTP endpoint not requiring
authentication will be hit by random traffic sooner or later, in a mostly
unpredictable matter.


Reply to this email directly, view it on GitHub
https://github.com/healthchecks/healthchecks/issues/701#issuecomment-1233904006,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ABV5MAESHYCKGKLOWPAK7F3V4BPY7ANCNFSM6AAAAAAQCBIGFQ
.
You are receiving this because you authored the thread.Message ID:
@.***>

<!-- gh-comment-id:1233948153 --> @DarrenPIngram commented on GitHub (Sep 1, 2022): Thank you for the very prompt response, information and solution which we will apply. It is strange as the web was only used for setting up the monitor and I fired the script via a command line. I get that stuff is scanned but it seemed very coincidental to happen so quickly! Anyway, we will go forward with your suggestion. May I just ask a final question rather than opening a new ticket? On your hosted service the /log endpoint exists in a URL. It does not seem to be on my self-hosted instance. I see nothing in the docs to suggest I need to set it up. Should it be there, or is that a unique feature to your hosted version? On Thu, 1 Sept 2022 at 11:06, Paul Haerle ***@***.***> wrote: > Browser often check links for either "safe-browsing" and/or local preview > rendering, a user agent such as DashLinkPreviews does sound like the > latter, no? > I think it's best to assume that any HTTP endpoint not requiring > authentication will be hit by random traffic sooner or later, in a mostly > unpredictable matter. > > — > Reply to this email directly, view it on GitHub > <https://github.com/healthchecks/healthchecks/issues/701#issuecomment-1233904006>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/ABV5MAESHYCKGKLOWPAK7F3V4BPY7ANCNFSM6AAAAAAQCBIGFQ> > . > You are receiving this because you authored the thread.Message ID: > ***@***.***> >
Author
Owner

@cuu508 commented on GitHub (Sep 1, 2022):

The /log endpoint was implemented in Healthchecks v2.3 – perhaps you are running an older version?

<!-- gh-comment-id:1233957942 --> @cuu508 commented on GitHub (Sep 1, 2022): The `/log` endpoint was implemented in Healthchecks v2.3 – perhaps you are running an older version?
Author
Owner

@DarrenPIngram commented on GitHub (Sep 1, 2022):

Ah, 2.2.1... need to make a new image. Thank you!

On Thu, 1 Sept 2022 at 11:48, Pēteris Caune @.***>
wrote:

The /log endpoint was implemented in Healthchecks v2.3 – perhaps you are
running an older version?


Reply to this email directly, view it on GitHub
https://github.com/healthchecks/healthchecks/issues/701#issuecomment-1233957942,
or unsubscribe
https://github.com/notifications/unsubscribe-auth/ABV5MAF53ZDWA4JFF6P4MCTV4BUUNANCNFSM6AAAAAAQCBIGFQ
.
You are receiving this because you authored the thread.Message ID:
@.***>

<!-- gh-comment-id:1233961639 --> @DarrenPIngram commented on GitHub (Sep 1, 2022): Ah, 2.2.1... need to make a new image. Thank you! On Thu, 1 Sept 2022 at 11:48, Pēteris Caune ***@***.***> wrote: > The /log endpoint was implemented in Healthchecks v2.3 – perhaps you are > running an older version? > > — > Reply to this email directly, view it on GitHub > <https://github.com/healthchecks/healthchecks/issues/701#issuecomment-1233957942>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/ABV5MAF53ZDWA4JFF6P4MCTV4BUUNANCNFSM6AAAAAAQCBIGFQ> > . > You are receiving this because you authored the thread.Message ID: > ***@***.***> >
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/healthchecks#502
No description provided.