[GH-ISSUE #1711] Invisble ratelimit leakage #1190

New issue

Open

opened 2026-05-07 00:30:57 +02:00 by BreizhHardware · 1 comment

BreizhHardware commented

2026-05-07 00:30:57 +02:00

Owner

Originally created by @mpeter50 on GitHub (Apr 20, 2026).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1711

🐞 Describe the bug

For the past few weeks I was experiencing notification delivery issues. It turned out the reason is that my IP address regularly reaches its message sending quota of 250 messages a day. It surprised me, because I receive far less messages, and I dont use Ntfy notifications for much things.
Perhaps I forgot about a poor project of mine? Maybe, but its not likely.

I have tried to diagnose the issue on my network, but I did not find the cause of the usage increasing.

💻 Components impacted

ntfy server

🔮 Additional context

I have installed blocking firewall rules on my routers, which verifyably block access to ntfy.sh, and yet the usage counter is still increasing.

iptables -I FORWARD -d 159.203.148.75/32 -j DROP

while true; do curl -s https://ntfy.sh/v1/account | jq --compact-output "$JQ_SCRIPT"; sleep 60; done

{"messages_sent":"048","messages_remaining":"202","date":"2026-04-20T20:13:34Z","date_unix":1776716014}
{"messages_sent":"048","messages_remaining":"202","date":"2026-04-20T20:14:35Z","date_unix":1776716075}
{"messages_sent":"048","messages_remaining":"202","date":"2026-04-20T20:15:35Z","date_unix":1776716135}
{"messages_sent":"048","messages_remaining":"202","date":"2026-04-20T20:16:36Z","date_unix":1776716196}
{"messages_sent":"048","messages_remaining":"202","date":"2026-04-20T20:17:37Z","date_unix":1776716257}
{"messages_sent":"056","messages_remaining":"194","date":"2026-04-20T20:18:37Z","date_unix":1776716317}
{"messages_sent":"056","messages_remaining":"194","date":"2026-04-20T20:19:38Z","date_unix":1776716378}
{"messages_sent":"060","messages_remaining":"190","date":"2026-04-20T20:20:38Z","date_unix":1776716438}
{"messages_sent":"060","messages_remaining":"190","date":"2026-04-20T20:21:39Z","date_unix":1776716499}
{"messages_sent":"060","messages_remaining":"190","date":"2026-04-20T20:22:39Z","date_unix":1776716559}
{"messages_sent":"060","messages_remaining":"190","date":"2026-04-20T20:23:40Z","date_unix":1776716620}
{"messages_sent":"060","messages_remaining":"190","date":"2026-04-20T20:24:40Z","date_unix":1776716680}
{"messages_sent":"064","messages_remaining":"186","date":"2026-04-20T20:25:41Z","date_unix":1776716741}
{"messages_sent":"064","messages_remaining":"186","date":"2026-04-20T20:26:41Z","date_unix":1776716801}
{"messages_sent":"064","messages_remaining":"186","date":"2026-04-20T20:27:42Z","date_unix":1776716862}
{"messages_sent":"064","messages_remaining":"186","date":"2026-04-20T20:28:43Z","date_unix":1776716923}
{"messages_sent":"064","messages_remaining":"186","date":"2026-04-20T20:29:43Z","date_unix":1776716983}
{"messages_sent":"064","messages_remaining":"186","date":"2026-04-20T20:30:44Z","date_unix":1776717044}
{"messages_sent":"064","messages_remaining":"186","date":"2026-04-20T20:31:44Z","date_unix":1776717104}

I blocked it only on the FORWARD chain so that I could still query the statistics. To verify that no other traffic is going to ntfy, e.g. from the router itself, I ran tcpdump, and I was seeing that traffic was only exchanged with the ntfy server when the stat query was running:

tcpdump -n -i eth0 vlan 2 and host 159.203.148.75

https://gist.github.com/mpeter50/718c654a15bb19a5cd8e049a14a58ef3

Originally created by @mpeter50 on GitHub (Apr 20, 2026). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1711 :lady_beetle: **Describe the bug**  For the past few weeks I was experiencing notification delivery issues. It turned out the reason is that my IP address regularly reaches its message sending quota of 250 messages a day. It surprised me, because I _receive_ far less messages, and I dont use Ntfy notifications for much things. Perhaps I forgot about a poor project of mine? Maybe, but its not likely. I have tried to diagnose the issue on my network, but I did not find the cause of the usage increasing. :computer: **Components impacted**  ntfy server :crystal_ball: **Additional context**  I have installed blocking firewall rules on my routers, which verifyably block access to ntfy.sh, and yet the usage counter is still increasing. ``` iptables -I FORWARD -d 159.203.148.75/32 -j DROP ``` ``` while true; do curl -s https://ntfy.sh/v1/account | jq --compact-output "$JQ_SCRIPT"; sleep 60; done ``` ```json {"messages_sent":"048","messages_remaining":"202","date":"2026-04-20T20:13:34Z","date_unix":1776716014} {"messages_sent":"048","messages_remaining":"202","date":"2026-04-20T20:14:35Z","date_unix":1776716075} {"messages_sent":"048","messages_remaining":"202","date":"2026-04-20T20:15:35Z","date_unix":1776716135} {"messages_sent":"048","messages_remaining":"202","date":"2026-04-20T20:16:36Z","date_unix":1776716196} {"messages_sent":"048","messages_remaining":"202","date":"2026-04-20T20:17:37Z","date_unix":1776716257} {"messages_sent":"056","messages_remaining":"194","date":"2026-04-20T20:18:37Z","date_unix":1776716317} {"messages_sent":"056","messages_remaining":"194","date":"2026-04-20T20:19:38Z","date_unix":1776716378} {"messages_sent":"060","messages_remaining":"190","date":"2026-04-20T20:20:38Z","date_unix":1776716438} {"messages_sent":"060","messages_remaining":"190","date":"2026-04-20T20:21:39Z","date_unix":1776716499} {"messages_sent":"060","messages_remaining":"190","date":"2026-04-20T20:22:39Z","date_unix":1776716559} {"messages_sent":"060","messages_remaining":"190","date":"2026-04-20T20:23:40Z","date_unix":1776716620} {"messages_sent":"060","messages_remaining":"190","date":"2026-04-20T20:24:40Z","date_unix":1776716680} {"messages_sent":"064","messages_remaining":"186","date":"2026-04-20T20:25:41Z","date_unix":1776716741} {"messages_sent":"064","messages_remaining":"186","date":"2026-04-20T20:26:41Z","date_unix":1776716801} {"messages_sent":"064","messages_remaining":"186","date":"2026-04-20T20:27:42Z","date_unix":1776716862} {"messages_sent":"064","messages_remaining":"186","date":"2026-04-20T20:28:43Z","date_unix":1776716923} {"messages_sent":"064","messages_remaining":"186","date":"2026-04-20T20:29:43Z","date_unix":1776716983} {"messages_sent":"064","messages_remaining":"186","date":"2026-04-20T20:30:44Z","date_unix":1776717044} {"messages_sent":"064","messages_remaining":"186","date":"2026-04-20T20:31:44Z","date_unix":1776717104} ``` I blocked it only on the FORWARD chain so that I could still query the statistics. To verify that no other traffic is going to ntfy, e.g. from the router itself, I ran tcpdump, and I was seeing that traffic was only exchanged with the ntfy server when the stat query was running: ``` tcpdump -n -i eth0 vlan 2 and host 159.203.148.75 ``` https://gist.github.com/mpeter50/718c654a15bb19a5cd8e049a14a58ef3

BreizhHardware added the

🪲 bug

label

2026-05-07 00:30:57 +02:00

BreizhHardware commented

2026-05-07 01:00:44 +02:00

Author

Owner

@mpeter50 commented on GitHub (Apr 20, 2026):

For clarification, I suspect there is a rate accounting bug in Ntfy, but primarily I am here to request some form of assistance, because I am out of ideas. On my side, it seems I am not actually sending notifications when the accounting increases.

wunter8 said in the Matrix room that debugging this might be problematic because there is not much logging on the ntfy.sh instance, but if you have a dev instance, and it would help, I could override the DNS results for my network to redirect traffic to it. But thats probably not too useful because of TLS certs.

@mpeter50 commented on GitHub (Apr 20, 2026): For clarification, I suspect there is a rate accounting bug in Ntfy, but primarily I am here to request some form of assistance, because I am out of ideas. On my side, it _seems_ I am not actually sending notifications when the accounting increases. wunter8 said in the Matrix room that debugging this might be problematic because there is not much logging on the ntfy.sh instance, but if you have a dev instance, and it would help, I could override the DNS results for my network to redirect traffic to it. But thats probably not too useful because of TLS certs.