[BUG] Banned for bad behavior in own webinterface because /img/flags/unknown.svg 404ed

[Restingo]

What happened?

I got locked out my own webinterface because the resource /img/flags/unknown.svg creates a 404 error:

Locale chosen in UI is German / Deutsch:

Path /usr/share/bunkerweb/ui/app/static/img/flags doesn't have this file.

Also I don't know why the geo IP lookup fails because it's a normal german IP if I enter it into db-ip.com directly.

How to reproduce?

Navigate to /reports and refresh a few times if there are IPs with unknown country.

Configuration file(s) (yaml or .env)

Relevant log output

2026/06/30 14:46:31 [error] 491298#491298: *842162 [METRICS] can't get country code mmdb country not loaded while logging request, client: XXX.XXX.XXX.XXX, server: bw.example.com, request: "GET / HTTP/2.0", host: "bw.example.com"
2026/06/30 14:46:32 [warn] 491298#491298: *842162 [ACCESS] IP XXX.XXX.XXX.XXX is banned with reason bad behavior (86286.716s remaining), client: XXX.XXX.XXX.XXX, server: bw.example.com, request: "GET / HTTP/2.0", host: "bw.example.com"
2026/06/30 14:46:32 [error] 491298#491298: *842162 [METRICS] can't get country code mmdb country not loaded while logging request, client: XXX.XXX.XXX.XXX, server: bw.example.com, request: "GET / HTTP/2.0", host: "bw.example.com"
2026/06/30 14:46:32 [warn] 491298#491298: *842162 [ACCESS] IP XXX.XXX.XXX.XXX is banned with reason bad behavior (86286.56s remaining), client: XXX.XXX.XXX.XXX, server: bw.example.com, request: "GET / HTTP/2.0", host: "bw.example.com"
2026/06/30 14:46:32 [error] 491298#491298: *842162 [METRICS] can't get country code mmdb country not loaded while logging request, client: XXX.XXX.XXX.XXX, server: bw.example.com, request: "GET / HTTP/2.0", host: "bw.example.com"
2026/06/30 14:46:59 [warn] 491298#491298: *842690 [ACCESS] IP XXX.XXX.XXX.XXX is banned with reason bad behavior (86259.325s remaining), client: XXX.XXX.XXX.XXX, server: bw.example.com, request: "GET / HTTP/2.0", host: "bw.example.com"
2026/06/30 14:46:59 [error] 491298#491298: *842690 [METRICS] can't get country code mmdb country not loaded while logging request, client: XXX.XXX.XXX.XXX, server: bw.example.com, request: "GET / HTTP/2.0", host: "bw.example.com"
2026/06/30 14:47:00 [warn] 491298#491298: *842690 [ACCESS] IP XXX.XXX.XXX.XXX is banned with reason bad behavior (86258.84s remaining), client: XXX.XXX.XXX.XXX, server: bw.example.com, request: "GET / HTTP/2.0", host: "bw.example.com"
2026/06/30 14:47:00 [error] 491298#491298: *842690 [METRICS] can't get country code mmdb country not loaded while logging request, client: XXX.XXX.XXX.XXX, server: bw.example.com, request: "GET / HTTP/2.0", host: "bw.example.com"

BunkerWeb version

1.6.11

What integration are you using?

Linux

Linux distribution (if applicable)

Ubuntu 24.04.2 LTS

Removed private data

• I have removed all private data from the configuration file and the logs

Code of Conduct

• I agree to follow this project's Code of Conduct

[TheophileDiot]

Hi @Restingo, thanks for the detailed report, the logs really helped pin this down.

Turns out there are two bugs stacking here, and one is causing the other.

The 404 loop. The /reports page draws a flag icon per row from the request's country code. When that code comes back as "unknown", the page tries to load /img/flags/unknown.svg, and that file doesn't actually exist, we only ship zz.svg/xx.svg as the unknown/local placeholder. The bans page and a couple other spots already map "unknown" to zz.svg correctly, the reports page just missed that case. That's a genuine bug on our side and we'll get it fixed.

Why that turned into a ban. badbehavior treats 404 as one of its default "bad" status codes, and it bans after 10 hits in 60 seconds for 24 hours. There's no exemption today for the UI's own static assets, so refreshing /reports a few times, if enough rows show an unknown country, is enough to trip that threshold and ban your own IP right at the BunkerWeb layer in front of your UI. That's why you got fully locked out instead of just seeing a broken icon.

Why the country came back unknown in the first place. That "mmdb country not loaded" message means the GeoIP database never got opened at all, it's not a failed lookup on your IP. BunkerWeb loads country.mmdb once when nginx starts, and if the job that downloads it hadn't finished (or had failed) at that exact moment, every worker just runs without a country DB until the next reload. That'd explain why even a normal German IP showed up unknown. Worth checking your scheduler logs around that time for the mmdb-country job, and confirming /var/cache/bunkerweb/jobs/country.mmdb actually exists on disk.

To get yourself unbanned right now, run this on the server:

bwcli unban <your-ip>

(bwcli bans first if you want to see what's currently listed.)

As a stopgap until the fix ships, on your Web UI service you can drop 404 from BAD_BEHAVIOR_STATUS_CODES:

BAD_BEHAVIOR_STATUS_CODES=400 401 403 405 429 444

Not ideal since it also stops badbehavior from reacting to real 404 scanning on that service, but it'll stop this specific self-ban loop. If you'd rather keep 404 monitored everywhere else and only carve out the broken path, WHITELIST_URI=^/img/flags/ on that service does the same job more narrowly.

We'll land the reports.js fix for the next release. Thanks again for the clean writeup, made this easy to track down 😄