Yo fedi, in case you've got a Hetzner server or VM, could you run curl https://www.bahn.de/web/api/reiseloesung/fahrt on it? Please run it just once, I don't wanna cause a dDoS and the replies won't change anyways :)

Specifically, I'm wondering whether you get an empty response (good) or a 403 (whoopsie).

empty response
9.4%
403 Access Denied
47.8%
see results
42.8%
Poll ended at .
Looks like they have indeed blocked most (major) hosters and possibly also some non-German residential IP ranges. May whoever has made this decision step barefoot on Legos until the day they undo it.
@derf they blocked some Canadian residential ips

@derf I think they're just using IP reputation classification (residential vs. industrial vs. datacenter) from Akamai.

AT&T Residential does also only get a 403 Access Denied.