Conversation

Notices

1. Embed this notice
   Tekniquelly correct (tek@freeradical.zone)'s status on Sunday, 23-Nov-2025 04:11:44 JST Tekniquelly correct

   in reply to

   • purple 👊✊💨
   • ansuz / ऐरन
   • Paul F. Temple, Esq.

   @pft @ansuz @purple Not so much. The IPs are so many and so ephemeral that it’s an eternal whack-a-mole. I ended up running a script like “get the IP’s ASN, look up all netblocks in that AS, and block them”. (Plug: and then compact them with https://github.com/kstrauser/littlefluffyclouds.)

   I ended up blocking all of Brazil with automation in the first 2 days. L

   • Doughnut Lollipop 【記録係】:blobfoxgooglymlem: likes this.
   • Embed this notice
     Paul F. Temple, Esq. (pft@infosec.exchange)'s status on Sunday, 23-Nov-2025 04:11:45 JST Paul F. Temple, Esq.

     in reply to

     • purple 👊✊💨
     • ansuz / ऐरन

     @tek
     Which is actually a great way to bootstrap an IP blocklist...
     @ansuz @purple

   • Embed this notice
     Tekniquelly correct (tek@freeradical.zone)'s status on Sunday, 23-Nov-2025 04:11:46 JST Tekniquelly correct

     • purple 👊✊💨
     • ansuz / ऐरन

     @ansuz @purple Yep, that’s exactly it. Add labciirlkabzyxoesjzg.example.com to DNS, get a cert for it, and you’ll start seeing targeted hits for that hostname in seconds.