{"id":6465,"date":"2026-05-22T18:32:12","date_gmt":"2026-05-23T01:32:12","guid":{"rendered":"https:\/\/catbradley.io\/?p=6465"},"modified":"2026-05-22T18:32:12","modified_gmt":"2026-05-23T01:32:12","slug":"in-a-weird-case-german-deutsche-bahns-website-was-locking-out-linux-users","status":"publish","type":"post","link":"https:\/\/catbradley.io\/?p=6465","title":{"rendered":"In a Weird Case, German Deutsche Bahn's Website Was Locking Out Linux Users"},"content":{"rendered":"

Since a few days now, people trying to plan a trip on Deutsche Bahn’s (DB) main booking website<\/a> have been getting stopped by error 751<\/em>. The site accused their web browser of acting like a bot, and even logging into accounts made no difference.<\/p>\n

So, what was actually triggering it? Just the word “Linux<\/em>” in the User-Agent<\/a> string it looks like. heise online<\/a> tested this by setting a Linux User-Agent<\/em> on Firefox under Windows and on Safari under macOS, and both got blocked.<\/p>\n

People noticed<\/h2>\n
\"an
Source: <\/em><\/i>MaksDampf<\/em><\/i><\/a><\/figcaption><\/figure>\n

Heise had picked up on a thread from Reddit’s r\/deutschebahn<\/a> as evidence that real users were being affected. Someone had posted about getting locked out just from clicking “earlier connections<\/em>” a few times while planning a trip.<\/p>\n

They, as you know, tested it on their end and found out that Linux systems were being blocked.<\/em><\/p>\n

Later in the thread, a commenter tied it to the wave of vibe-coded projects, specifically ones built to scrape Deutsche Bahn’s fare data. Another commenter identified themselves as a DB employee, pointing out that internal staff have to deal with DB Systel’s problems regularly. <\/p>\n

Before you ask, <\/em>DB Systel<\/em><\/a> is the train operator’s IT and digital solutions provider.<\/em><\/p>\n

DB’s official response<\/h2>\n

Deutsche Bahn has responded<\/a> to heise online. A spokesperson said Linux users are supposed to be able to use bahn.de and DB Navigator<\/a> without issues, and that the company’s security systems look at traffic behavior, request origins, and browser traits to identify potential threats.<\/p>\n

Normal traffic can get caught in this sometimes<\/strong>, they said, while emphasizing that they are working to bring those cases down. Heise ran a test again the same day and found out that a Linux User-Agent on a Windows machine still triggered the block.<\/p>\n

I ran two tests of my own<\/strong>. The first was on a Fedora Workstation<\/a> system with a VPN active, where I accessed bahn.de<\/em> on Firefox in private mode and spammed various header menu options, reloading repeatedly.<\/p>\n

\"a<\/figure>\n

The portal never locked me out. I did the same on an Ubuntu<\/a> virtual machine and got the same result. So it is safe to assume the fixes have been made, though false positives may still happen occasionally.<\/p>\n

\n

Suggested Read \ud83d\udcd6: <\/strong>Rust Could Eliminate 80% of Linux Kernel CVEs<\/em><\/a><\/p>\n

<\/p>","protected":false},"excerpt":{"rendered":"

Since a few days now, people trying to plan a trip on Deutsche Bahn’s (DB) main booking website have been getting stopped by error 751. The site accused their web…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":[],"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[1],"tags":[],"class_list":["post-6465","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-rss"],"_links":{"self":[{"href":"https:\/\/catbradley.io\/index.php?rest_route=\/wp\/v2\/posts\/6465","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/catbradley.io\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/catbradley.io\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/catbradley.io\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/catbradley.io\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6465"}],"version-history":[{"count":0,"href":"https:\/\/catbradley.io\/index.php?rest_route=\/wp\/v2\/posts\/6465\/revisions"}],"wp:attachment":[{"href":"https:\/\/catbradley.io\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6465"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/catbradley.io\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6465"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/catbradley.io\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6465"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}