Possible security issue.

[Shidapu 14]

I'm blocking Russia for a long time, but recently Cloudflare reports the  following from Russia being blocked. 
I have about 8-20k per month of active blocks. 

Crawlers doesn't seem to obey the robots.txt in root directory.
I can only read the robots.txt file with /web/robots.txt
Nginx is set up with following:

location = /robots.txt {

    add_header  Content-Type  text/plain;

    return 200 "User-agent: *\nDisallow: /\n";

    }

It seems to be leaking info on content on the server, it is making me uncomfortable..  Should i be worried?

 

Example:

User agent

Mozilla/5.0 (compatible; YandexBot/3.0; +http://yandex.com/bots)

 

/emby/Users/18b39526303643db917b7739d4c02baa/Views

Edited March 11, 2022 by Shidapu

[Luke 42083]

That /views api is an authenticated request, so they could only get that far if they've logged in successfully.

[Shidapu 14]

16 minutes ago, Luke said:

That /views api is an authenticated request, so they could only get that far if they've logged in successfully.

All accounts are password protected with strong local passwords, 99% of the accounts are connected with Emby Connect accounts.
3 local accounts in total, not allowed remotely, without passwords.

I cannot see any account in control panel with suspect ip addresses in Russia.
I have only 1 user with tech knowledgeable to actually VPN from Russia if he wanted to, all the others users does not.
All users are hidden by default.

Edited March 11, 2022 by Shidapu