Preview iOS app triggers CrowdSec HTTP Probing

*Issue initially posted in the iOS app thread, opening a new thread as suggested.

I encountered a niche case but I think it’s worth reporting. This issue does not happen with the older (public) Plex app, it only happens with the Preview app, that’s why I am posting here.

Due to CGNAT, I use a custom server access URL. This URL is a subdomain being reverse proxied through a VPN to the machine running the Plex server.
The server relaying the traffic is a VPS.

The VPS has CrowdSec installed to protect from attacks.

Using the Plex Preview app triggers an http probing alert in CrowdSec, resulting in the IP being banned and therefore the app not being accessible until I manually delete the CrowdSec decision.

This issue only happens when accessing the app outside of the local network and traffic is relayed through the afore-mentioned server.

I am guessing some network requests may need to be refactored in order to avoid triggering such decisions.

I don’t think that the custom server access URL and the VPS play a role, I am guessing that if you install CrowdSec and try to access the server with the new app, you will be able to reproduce it.

Additional information that might be helpful:

This scenario takes remediation “against a single IP that requires multiple different (http path) pages that end up in 404/403/400.”

So maybe a lot of requests from the new Plex Preview iOS app end up in 404/403/400?

Github