AMO returns an empty HTTP 406 from privately operated VPN server 185.117.72.109

I cannot access the public AMO website or use web-ext sign from my privately operated VPN server. Please investigate a possible Fastly/WAF false positive affecting this source IP.

• Source IPv4: 185.117.72.109
• Network: AS60117 Host Sailor Ltd
• Exit country reported by Cloudflare/IPinfo: Netherlands
• Reproduction time: 2026-09-14 13:05:00 UTC
• Affected URLs:
  • https://addons.mozilla.org/en-US/firefox/
  • https://addons.mozilla.org/api/v5/addons/upload/

Both URLs return HTTP 406 with an empty body, including credential-free requests made directly from the VPN server. This also reproduces in Windows curl, Node fetch, and a clean isolated Edge browser session. Firefox request headers do not change the result. Pinning the hostname to each of its four DNS addresses produces the same response. TLS certificate checking remains enabled.

Minimal credential-free reproduction, run directly on the VPN server:

curl --ipv4 --silent --show-error --max-time 20 --dump-header - --output /dev/null https://addons.mozilla.org/en-US/firefox/

Response from the VPN server:

HTTP/2 406
cache-control: private, no-store
accept-ranges: bytes
via: 1.1 varnish, 1.1 varnish
date: Mon, 14 Sep 2026 13:05:00 GMT
x-served-by: cache-bfi-krnt7300037-BFI, cache-bfi-krnt7300037-BFI, cache-ams-eham8680057-AMS
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-timer: S1789391101.776188,VS0,VE146

web-ext 10.6.0 then reports WebExtError: Unexpected end of JSON input, because it attempts to parse the empty 406 body. The extension itself passes local web-ext lint with zero errors, notices, and warnings.

Please identify the rule causing this rejection and remove any erroneous block for this source IP/network. I operate this VPN privately and want to retain the same server. No AMO credentials are included in this report.

┆Issue is synchronized with this Jira Task

Start with the synchronized Jira task AMOENG-2798 and reproduce the empty HTTP 406 using the provided curl command against both affected AMO URLs. Investigate the Fastly/WAF rule affecting source IP 185.117.72.109 or AS60117; done means the false positive is removed and credential-free requests no longer receive the empty 406 response.