Post #2325456
2026-05-06 22:10 UTC
@JulianOliver@mastodon.social @Soblow@eldritch.cafe Huh, in my fail2ban list (4308 records) and your list (2185 records) — there are only 23 matches. Most of them from ASN 8075 (Microsoft network); also there are IPs from ASN 15169 and ASN 32934.
Looks like pretty bad — possibly, the amount of bots' IPs is so big that they almost doesn't intersect between two random hosts :drgn_sigh:
List of matched IPs:
57.141.20.0
57.141.20.14
57.141.20.59
57.141.20.6
66.249.66.162
74.7.175.185
74.7.227.11
74.7.227.135
74.7.227.156
74.7.227.175
74.7.227.42
74.7.228.29
74.7.230.15
74.7.230.34
74.7.230.47
74.7.241.16
74.7.241.18
74.7.241.21
74.7.242.14
74.7.242.3
74.7.242.47
74.7.243.216
74.7.244.30
Replies (1)
-
@JulianOliver@mastodon.social 2026-05-06 22:18
@evgandr@mastodon.bsd.cafe @Soblow@eldritch.cafe Very interesting. Yes I suspect it is gigantic, spread out over ranges they've bought up. Swathes of the already exhausted v4 space clearly dedicated to this. I saw big swings across subnets from the same UA, so I guess they're just pointing their wasp swarms based on some combination of network distance, load balancing and/or harvest metric.