1892625 - leroymerlin.fr / sncf-connect.com CAPTCHA and then blocks

Status: RESOLVED WORKSFORME

(Web Compatibility :: Site Reports, defect, P1)

Description

[:gerard-majax]

STR:

1. Reach https://www.leroymerlin.fr/
2. CDN reports you are on the same network as a bot (?)
3. Solve CAPTCHA
4. "You're blocked"

I'm not using a VPN, just plan Orange FR FTTH.

Repro on:

• Nightly Linux desktop (Android is fine for me) upto 2023-04-13 according to mozregression
• Current stable (snap) still shows CAPTCHA but grants access, as well as under Chromium

Running mozregression got me this https://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=a445f1762c895000bcdabd9d95697522359d41ed&tochange=5c9aa60ea6f47114a9367f56c50cd13299aa1d29

No enhanced tracking protection as much as I know, no uBlock enabled, repro in private window with tracking protection disabled, wondering how much it might be similar to bug 1840235, given it repros back in time and I clearly accessed the website a few days/weeks ago from the same IP and computer...

Comment 1

[:gerard-majax]

Attachment: Capture d’écran du 2024-04-21 15-44-20.png

Comment 2

[:gerard-majax]

Attachment: Capture d’écran du 2024-04-21 15-44-42.png

Comment 3

[:gerard-majax]

Looks like the error is served from https://geo.captcha-delivery.com/captcha/?initialCid=[...]==&hash=[...]&cid=[...]&t=fe&referer=https://www.leroymerlin.fr/&s=[...]&e=[...]&dm=cd

Comment 4

[:gerard-majax]

And the 403 occurs on the leroymerlin.fr server, reporting LMCDN

Comment 5

[:gerard-majax]

$ host www.leroymerlin.fr
www.leroymerlin.fr is an alias for j.sni.global.fastly.net.
j.sni.global.fastly.net has address 199.232.170.132

Comment 6

[:gerard-majax]

This morning it's working? Did they react to my support message request on the blocking page ?

Comment 7

[Dennis Schubert [:denschub]]

This site is another site hosted by Fastly, and we've seen a bunch of those reports. Let's add a KB bug and try to reach out.

Comment 8

[:gerard-majax]

I also saw reports about Intermarché: https://mamot.fr/deck/@[e-mail]/112319351773058388

Comment 9

[:gerard-majax]

Now happening on sncf-connect, which is going to be really really complicated ...

Comment 10

[:gerard-majax]

They all seem to use geo.captcha-delivery.com service

Comment 11

[Sylvestre Ledru [:Sylvestre]]

Dennis, do you know if we have contacts at captcha-delivery?

Comment 12

[Dennis Schubert [:denschub]]

That is Fastly. I'm trying to find a contact.

Comment 13

[Lars Eggert [:lars]]

I alerted a friend at Fastly.

Comment 14

[Dennis Schubert [:denschub]]

This issue was fixed upstream, so there's nothing left for us to do here. Closing.