Posted on

More ASes blocked from my web server

The following ASes are now blocked from my home network.

  • 208077 COMPASTELECOM LLP (KZ)
  • 41039 Timer, LLC (RU)
  • 8717 A1 Bulgaria EAD (BG)
  • 39927 E-Light-Telecom Ltd. (RU)
  • 17557 Pakistan Telecommunication Company Limited (PK)
  • 12997 OJSC Kyrgyztelecom (KG)
  • 24921 Latvijas Mobilais Telefons SIA (LV)
  • 133278 Dehradun Enet Solutions Private Ltd (IN)
  • 45536 Readylink Internet Services Limited (IN)
  • 37061 Safaricom (KE)
  • 36947 ALGTEL-AS (DZ)
  • 9260 Multinet Pakistan Pvt. Ltd. (PK)
  • 141334 Skynet Digital Services Pvt. Ltd. (IN)
  • 36994 Vodacom-VB (ZA)
  • 48004 PE Tsibrankov Konstantin Igorevich (UA)
  • 3326 Datagroup PRIVATE JOINT STOCK COMPANY (UA)
  • 134032 INFONET COMM ENTERPRISES (IN)

This was triggered by the following log entries.

212.46.56.169 - - [22/Apr/2024:04:43:14 -0400] "GET /wp-login.php HTTP/1.1" 301 239
195.184.214.82 - - [22/Apr/2024:04:44:16 -0400] "GET /wp-login.php HTTP/1.1" 301 239
195.24.40.178 - - [22/Apr/2024:04:45:41 -0400] "GET /wp-login.php HTTP/1.1" 301 239
176.196.46.109 - - [22/Apr/2024:04:46:04 -0400] "GET /admin/ HTTP/1.1" 301 233
182.180.35.167 - - [22/Apr/2024:04:46:30 -0400] "GET /admin/ HTTP/1.1" 301 233
212.97.4.143 - - [22/Apr/2024:04:47:21 -0400] "GET /admin/ HTTP/1.1" 301 233
80.89.79.165 - - [22/Apr/2024:04:48:07 -0400] "GET /admin/ HTTP/1.1" 301 233
103.230.153.134 - - [22/Apr/2024:04:49:27 -0400] "GET /downloader/ HTTP/1.1" 301 238
103.230.153.134 - - [22/Apr/2024:04:49:29 -0400] "GET /downloader/ HTTP/1.1" 404 196
103.230.153.134 - - [22/Apr/2024:04:49:33 -0400] "GET /admin.php HTTP/1.1" 301 236
103.21.79.131 - - [22/Apr/2024:04:49:56 -0400] "GET /admin.php HTTP/1.1" 301 236
41.139.174.67 - - [22/Apr/2024:04:50:20 -0400] "GET /admin.php HTTP/1.1" 301 236
41.104.30.47 - - [22/Apr/2024:04:50:32 -0400] "GET /admin.php HTTP/1.1" 301 236
125.209.67.210 - - [22/Apr/2024:04:51:40 -0400] "GET /Backoffice/ HTTP/1.1" 301 238
125.209.67.210 - - [22/Apr/2024:04:51:41 -0400] "GET /Backoffice/ HTTP/1.1" 404 196
103.159.107.172 - - [22/Apr/2024:04:51:44 -0400] "GET /administrator/ HTTP/1.1" 301 241
105.246.210.136 - - [22/Apr/2024:04:52:08 -0400] "GET /administrator/ HTTP/1.1" 301 241
195.18.19.81 - - [22/Apr/2024:04:53:04 -0400] "GET /administrator/ HTTP/1.1" 301 241
93.183.203.243 - - [22/Apr/2024:04:53:25 -0400] "GET /administrator/ HTTP/1.1" 301 241
103.58.115.60 - - [22/Apr/2024:04:53:39 -0400] "GET /administrator/ HTTP/1.1" 301 241

Note that all of the probes seen in the log above occurred within about 10 minutes. Also note that almost none of them handled 301. This is the signature of a poorly implemented botnet. Also note that they’re all from continents other than my own.

I’m still working on the automation for this, but the scheme is working. For a given nefarious query, I look up the route in the global BGP routing table to find the origin AS (in my local copy, using my Ipv4Routes class). I then look up the country for the origin AS, and based on my configured policy, block the entire AS for up to 2 years. For example, Russian (RU) ASes are always blocked for 2 years.

Later I saw similar activity that triggered the blocking of the following ASes.

  • 35816 SEVSTAR Lancom Ltd. (RU)
  • 53754 SYSTEMA Ltd (RU)
  • 58310 TELEPORT LLC (RU)
  • 208142 LLC Rocket Telecom (RU)
  • 7303 Telecom Argentina S.A. (AR)
  • 28075 ARLINK S.A. (AR)
  • 5384 EMIRATES TELECOMMUNICATIONS GROUP COMPANY (ETISALAT GROUP) PJSC (AE)
  • 7418 TELEFONICA CHILE S.A. (CL)
  • 9541 Cyber Internet Services Pvt Ltd. (PK)
  • 12735 TurkNet Iletisim Hizmetleri A.S. (TR)
  • 13489 EPM Telecomunicaciones S.A. E.S.P. (CO)
  • 17858 LG POWERCOMM (KR)
  • 25553 TRK Gluhov Ltd. (UA)
  • 28458 IENTC S DE RL DE CV (MX)
  • 35457 Etisalcom Bahrain Company W.L.L. (BH)
  • 62240 Clouvider Limited (GB)
Posted on

Unacknowledged SYNs by country, April 16 2024

To anyone who thinks that things haven’t become considerably worse here in the U.S. with respect to cloud computing… this chart shows a partial day of unacknowledged TCP SYNs sent to my gateway from the public Internet, for the top 25 countries. U.S. infrastructure is the worst offender by a decimal order of magnitude versus the 2nd place offender. Most of the TCP SYNs are directed at ports 80, 443 and 22. They’re unacknowledged because I’m blocking access from many of our cloud and hosting providers. Why? Because nearly all (more than 99.99%) of the traffic I see from them is nefarious (attempted logins, probing for vulnerabilities, etc.).

Posted on

China remains a deplorable netizen

Below is a typical example of what happens when some of my pf table entries expire for China. A DDoS attack.

I reactivated my drop table entries for 110.152/14, 182.200/13 and 123.244/14.

182.204.140.207 - - [13/Apr/2024:22:17:18 -0400] "GET / HTTP/1.1" 200 82 "-"
182.204.140.207 - - [13/Apr/2024:22:17:18 -0400] "GET / HTTP/1.1" 200 82 "-"
182.204.140.207 - - [13/Apr/2024:22:17:19 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:19 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:20 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:20 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:21 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:21 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:21 -0400] "GET / HTTP/1.1" 200 82 "-"
182.204.140.207 - - [13/Apr/2024:22:17:21 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:21 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:22 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:23 -0400] "GET / HTTP/1.1" 200 82 "-"
182.204.140.207 - - [13/Apr/2024:22:17:23 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:23 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:24 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:24 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:24 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:25 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:25 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:25 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:25 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:26 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:26 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:26 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:26 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:27 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:27 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:27 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:27 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:28 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:28 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:28 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:29 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:29 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:29 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:30 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:31 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:31 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:32 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:32 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:32 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:32 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:33 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:33 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:34 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:34 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:34 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:34 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:35 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:35 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:35 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:35 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:36 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:36 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:36 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:37 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:37 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:37 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:38 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:38 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:39 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:39 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:39 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:40 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:40 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:40 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:17:40 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:41 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:42 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:42 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:42 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:42 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:42 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:43 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:43 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:44 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:44 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:45 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:45 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:45 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:46 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:46 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:47 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:47 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:47 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:48 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:48 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:17:48 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:49 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:49 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:49 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:50 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:50 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:50 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:51 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:51 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:51 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:52 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:52 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:52 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:52 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:52 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:53 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:53 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:53 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:54 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:54 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:55 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:17:55 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:55 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:56 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:56 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:56 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:57 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:57 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:57 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:57 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:17:58 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:17:58 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:17:59 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:17:59 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:18:00 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:00 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:00 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:01 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:01 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:02 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:02 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:02 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:03 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:03 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:03 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:18:03 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:04 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:04 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:05 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:06 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:07 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:07 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:18:07 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:08 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:18:09 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:10 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:10 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:11 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:11 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:12 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:18:12 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:13 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:13 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:14 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:14 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:14 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:18:15 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:15 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:16 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:16 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:17 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:17 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:18:18 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:18 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:19 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:19 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:20 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:20 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:21 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:18:21 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:22 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:23 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:23 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:25 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:25 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:18:25 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:25 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:27 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:27 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:28 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:30 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:31 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:31 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:31 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:32 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:18:32 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:33 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:33 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:34 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:35 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:35 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:18:35 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:36 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:36 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:37 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:18:37 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:37 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:39 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:39 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:18:39 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:40 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:41 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:41 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:18:41 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:42 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:42 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:43 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:43 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:18:44 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:44 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:45 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:45 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:47 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:47 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:47 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:18:47 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:48 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:49 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:18:49 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:18:51 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:51 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:51 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:51 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:18:52 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:52 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:53 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:18:53 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:54 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:54 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:18:55 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:55 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:56 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:18:56 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:56 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:18:57 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:18:58 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:18:58 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:18:58 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:18:59 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:00 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:00 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:00 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:19:01 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:02 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:02 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:03 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:03 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:19:03 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:05 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:05 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:06 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:19:07 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:07 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:08 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:09 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:09 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:19:09 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:10 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:11 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:11 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:11 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:12 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:13 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:13 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:19:15 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:15 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:15 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:16 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:17 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:19:19 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:19 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:19 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:19 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
123.244.129.117 - - [13/Apr/2024:22:19:21 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:21 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:19:22 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:22 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:22 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:24 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:25 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:25 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:26 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:19:26 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:28 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:28 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:29 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:29 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:19:30 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:30 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:31 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:32 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:32 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:33 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:19:34 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:34 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:34 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:36 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:19:36 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:37 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:38 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:38 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:19:38 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:40 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:41 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:41 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:19:41 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:42 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:43 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:43 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:19:44 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:45 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:45 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:45 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:47 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:47 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:48 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:19:48 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:48 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:49 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:50 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:50 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:19:51 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:51 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:51 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:51 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:19:52 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:52 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:52 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:53 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:55 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:55 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:19:55 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:55 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:56 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:57 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:19:57 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:19:59 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:19:59 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:19:59 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:20:00 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:20:00 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
123.244.129.117 - - [13/Apr/2024:22:20:02 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:20:02 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:20:02 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:04 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:20:04 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:20:06 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:06 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:20:07 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:20:07 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:20:08 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:20:08 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:20:09 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:20:10 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:20:10 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:10 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:20:11 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:20:12 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:12 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:20:12 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:20:13 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:13 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:20:14 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
123.244.129.117 - - [13/Apr/2024:22:20:15 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:20:15 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:20:15 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:17 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:20:17 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
182.204.140.207 - - [13/Apr/2024:22:20:18 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:18 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:20:19 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:20:20 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
182.204.140.207 - - [13/Apr/2024:22:20:21 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:22 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:20:22 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:20:23 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:20:24 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
123.244.129.117 - - [13/Apr/2024:22:20:25 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:20:25 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:20:26 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:20:27 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:20:27 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
123.244.129.117 - - [13/Apr/2024:22:20:30 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:20:30 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:20:31 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
123.244.129.117 - - [13/Apr/2024:22:20:33 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:20:33 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
123.244.129.117 - - [13/Apr/2024:22:20:34 -0400] "GET /piwigo HTTP/1.1" 301 238 "-"
110.154.102.196 - - [13/Apr/2024:22:20:36 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:38 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:40 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:42 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:45 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:48 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:50 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:51 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:54 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:20:57 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:21:00 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:21:04 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:21:06 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:21:07 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:21:09 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:21:11 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:21:14 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:21:16 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:21:18 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:21:21 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:21:23 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
110.154.102.196 - - [13/Apr/2024:22:21:26 -0400] "GET /piwigo HTTP/1.1" 301 242 "-"
Posted on

Drop garbage web traffic: first manual pass complete, automation and weekly JSON file coming soon

I’m basically done with my first pass at manually adding networks to block from my web server, based on my web server logs and a whole lot of queries to dwmrdapd (my secure RDAP aggregator / cache).

It’s kind of amazing how many HTTP requests are just garbage. My definition of garbage: scraping (presumably to feed an LLM or other AI training) and attack probing. While I’m still allowing Google and Apple crawler bots, my average traffic has been reduced by around 75%. I’m not surprised or astounded. I’m just VERY disappointed at what the modern Internet has become. Especially since a lot of the traffic is clearly state sponsored vulnerability probing. Not to mention attempts at mapping IP addresses to location and identity, many of those coming from networks in China, Vietnam, Singapore and Russia.

In the plots below, you can see the result of the manual work I started on 3/16. Tedious work each night, but the results speak for themselves. I did add more automation for things the script kiddies are trying to find.

I’m still working on a larger effort to block all networks inside autonomous systems (ASes) that are cloud providers. That’s because to date, 99.99% of the traffic my site sees from them is unwanted traffic. A miniscule percentage is valid VPN exit traffic. But I’m at the point where I’m no longer going to tolerate the monetized weaponization of cloud infrastructure at my expense. Cloud providers aren’t going to get a free pass anymore. Their behavior at this point is analogous to that of arms dealers. They’re making money selling weapons used against us, and meanwhile try to sell us cloud services for ‘security’. Amazon, Google, Microsoft, OVH, DigitalOcean, Hetzner, Linode, Hurricane Electric and many other smaller hosting service providers… you’re becoming deplorable. You can keep buying up address space and using it against us, but soon I’ll have automation that keeps finding all of your address space and blocking it. And I’ll be putting a JSON file online at least weekly so others can do the same if desired. Parts of your business model are hostile to small websites, and I’m not the only one that’s tired of it. If you’d bother to do DPI and police your own users, I wouldn’t have to spend my time creating this automation.

In the long run… I’ll go out on a limb and say this model isn’t sustainable. I’m not interested in hosting my applications in someone else’s datacenter, co-resident with vandals (many of whom I’m sure are just as interested in side-channel attacks within the cloud infrastructure as they are in attempting to break in to my web site). And I’m not alone. At some point you’ll have to clean up your act, else large portions of the web just won’t be accessible from your infrastructure because we (those producing content) will just drop all of your traffic (including your search indexing crawlers). It won’t just be the big guys like The New York Times, Reddit, et. al.

Posted on

2024 NCAA Women’s basketball tournament Elite 8 matchups

I’m super excited for the 2 games in the NCAA women’s basketball tournament tonight. A rematch of last year’s championship game, Iowa versus LSU. Caitlin Clark and Angel Reese. A 1 seed against a 3 seed. Should be a great game. I’d like Iowa to win this one, but that’s because I’d like to see their seniors leave the tournament with a ring. Namely Caitlin Clark, Gabbie Marshall, Kate Martin and Molly Davis.

Then we have USC versus Connecticut. Another. 1 seed versus 3 seed. The frosh JuJu Watkins (so fun to watch!) and Paige Bueckers back from two surgeries and maybe the most efficient player in the game.

So much talent and great coaching on both sides in both of these games. I’ve been watching the women’s game for a few years now, and I honestly find it a better product than the men’s game. I think a big part of it is just the reason I watch college sports: it’s fun to watch players develop in leaps and bounds over several years, watch teams gel and become one. It feels like we no longer have that in the men’s game. And it’s slowly going away in the women’s game too. Watch it while you can; the transfer portal and NIL are changing college sports, and so far it feels to me like it’s for the worse. As a big example of the moment… Georgia Amoore entered the transfer portal today. Not all that surprising given that coach Kenny Brooks left for Kentucky last week, but as a senior who would likely be a first-round WNBA pick, it feels sad to me. Virginia Tech is going to find it hard to fill her vacancy.

I’d like to touch on the drama surrounding Kim Mulkey. I didn’t read the LA Times story nor The Washington Post story. In large part because I don’t really care. From what I’ve seen, the LA Times story was particularly egregious while The Washington Post was mostly quotes from Mulkey’s book and former players and coaches. I’m not a fan of Mulkey, but it’s mostly because I feel like she could’ve been a lot more positive and supportive during Brittney Griner’s imprisonment in Russia, and I really didn’t like her comments about the altercation with South Carolina in the SEC tournament final. I don’t know her, obviously, but it seems when given the opportunity to choose, she picks the low road. Given the vicious hair pull from Angel Reese on Kamilla Cardoso during the SEC championship game, Mulkey had an opportunity, and chose the wrong road. Dawn Staley, on the other hand, took the high road and was graceful and professional. Anyone that says basketball isn’t a contact sport doesn’t watch the game, but I personally want to see clean, fair competition within the rules. Cardoso was ejected and suspended for a game, and that was appropriate. Reese should have been ejected and suspended for the hair pull on Cardoso, but the officials missed it. Makes me wish the NCAA had post-game review processes like professional leagues.

Lots of people were annoyed with Angel Reese after last year’s championship game for the ring finger taunt toward Caitlin Clark. This doesn’t bother me. Trash talk is part of the game, and anyone that thinks Caitlin doesn’t do the same hasn’t watched her play or is just willfully ignorant. She’s not an angel, and that’ s not a dig: humans are not angels. Reese isn’t an angel (despite her first name). Bueckers isn’t an angel. Cardoso isn’t an angel. Brink isn’t an angel. JuJu Watkins isn’t an angel. Osborne and Betts aren’t angels. But they’re all great competitors who’ve worked their tails off to get to where they are, and they’re fun to watch on the basketball court!

Posted on

Big Tech arms race is out of control; it’s time to bolster defenses

I recently posted about doing my annual web log perusal and adding more networks to the list which I block from accessing my web server. Until 2021 or so, most of the networks I added were what I’d consider hostile netizens, and most of them in foreign countries (China far and away the worst offender, followed by Russia, Singapore, Hong Kong and others).

Around 2021 (maybe earlier), I started seeing more attacks coming from cloud infrastructure. Today, after my first full pass of changes (March 17, 2024), it’s the majority.

As an aside, how do I know that many of the adversaries are foreign? Well, after my first pass of changes, it’s pretty clear that a lot of them were far away (by network round-trip time). Below are plots of traffic and round trip times to clients of my web server, from before my changes and right after my changes. Note how the 95th and 75th percentile round trip times dropped dramatically. That’s because many of the nefarious users were far away.

It’s worth noting that much of my traffic is local to my home. I have many Raspberry Pis and other hosts running my ‘mcrover’ software, and one of the things it does it monitor my web server, including queries to my blog and the gallery software for Randy’s site since they have database backends I want to be sure are running. This background monitoring traffic works out to about 80 kilobits/second on average. The round trip time for this traffic is tiny; for some hosts it’s sub-millisecond since they have 10 gigabit connections (DAC, fiber or 10GbaseT).

Back to the topic at hand…

Late last year I got a question via email from a customer at DigitalOcean as to why I had blocked their access. I didn’t reply. I’ve come to the conclusion that if users won’t police themselves, and their cloud provider won’t police their users (and expects us to help them do the policing!), neither deserve my time. If you, or your customer, are getting 404’s from my website for URLs like ‘/login.php’ (which doesn’t exist and has never existed on my site), you’re either a criminal or an accomplice. Neither of you deserve my time. Your activities are hostile, period.

Since 2021 or so, the more disturbing trend I see seems to be driven by the AI arms race in big tech. Microsoft (and OpenAI), Google and Apple crawling my web site with more frequency, and pulling everything they can find. PDFs, all images, etc. There was a time when I considered it OK, in the sense that it was used only for search purposes, which at least gives back a bit to the web as a whole (search is a useful service, despite the mess it has become). But today, it’s pretty clear to me that the snarfing of data by big tech is not balanced by a benefit to users of the web. It’s also quite aggressive. How do I benefit from Microsoft downloading every PDF and image that’s on my web site? I don’t. I lose (I pay for my bandwidth), they profit. There is literally zero benefit to me, or you unless you’re Microsoft or OpenAI.

I’ve grown tired of this. I’m not interested in feeding the LLMs, much less allowing cloud infrastructure to be leveraged against my web site. So as of this week, anytime I happen to be doing some block list maintenance and see traffic from a cloud service or big tech, the network will be blocked. And not just small chunks; the entire CIDR allocation. And not just for a short period of time; 2 years. If you manage to get your act together 2 years from now, great. If not, you’ll be blocked for 2 more years. I anticipate the latter, since that’s been the steady course for the last 7 years.

I’ve already blocked large swaths of Amazon, Microsoft, Google, DigitalOcean, Linode, Hetzner, Hurricane Electric, OVH and other cloud services. There is literally no reason I should see requests from any of these address spaces. They’re not human beings reading my web pages. They are nefarious automation, and not policed by the cloud providers. We are the victims. Ideally the cloud providers would be using deep packet inspection and proactively shut down such activities. But if no one is going to jail for their paying customers’ illicit activities… nothing gets done. And most of us don’t have time to do the policing for them. It’s MUCH faster for me to just block the cloud provider’s entire address space. I’m not going to play wack-a-mole, nor serve as their unpaid reporter of nefarious activity they’re enabling. A simple buh-bye to the cloud provider and all of their customers is my far and away best option. This isn’t a rash decision on my part; I’ve seen nefarious traffic from the cloud providers for many years, and given that they hold gobs of address space, it’s futile to block only small parts. The only sane course is to block all of their address space. In particular, I’m talking to you Amazon, Google, DigitalOcean, Hetzner, Linode, Microsoft and OVH.

It is highly likely that I’ll soon be blocking crawler address space belonging to Google, Apple, Microsoft and others. Sad but true that the benefit of being indexed by search engines has finally been eclipsed by the downsides of allowing unfettered access from big tech. robots.txt doesn’t get us there because it doesn’t have the granularity we need, and the reality is that many of the crawlers don’t even bother to look at it. Worse, how are we as web site admins supposed to be able to determine how the data is being used? If the request is coming from Google crawler address space, is it for search or for feeding their LLMs? Or for sale to a third party? Or for driving their ad revenue? The reality is that we don’t know, and have no means of knowing. I’d rather my web site disappear from search than have all of my web site data used against me in some manner (which includes directed advertising). And I’m tired of the amount of bandwidth it consumes. Google alone is responsible for over 3,000 downloads from my web site per week. Honestly, it’s pretty disgusting. My site is a TINY personal web site, mostly for my own use. I can’t imagine the barrage of traffic from Google to large web sites.

If you happen to be a victim of the more aggressive blocking I’m about to start and the automation that will maintain it long term, my apologies. But I’m unlikely to be sympathetic to pleas for access. If your neighbor attacks my site and my automation blocks the network you share with them as a result… I am truly sorry, but I don’t have time to poke tiny holes as exceptions. I’ll likely leave the 30 day with geometric escalation policy in place for U.S. broadband users, but if you’re using a VPN through a cloud provider and someone else uses that provider to abuse my web site… you’ll be out of luck for much longer. Again, my apologies. If you want to do something about what’s been happening for years on this front that’s forcing some of us to block large swaths of cloud provider space and probably soon the web crawlers of Google, Microsoft, Apple and others… reach out to your legislators. If you’re in the U.S., maybe just making them aware that cloud services on U.S. soil are being used every minute of every day to attack law abiding, tax paying citizens who just want to share knowledge with other citizens. Good luck, godspeed, live long and prosper.

Posted on

mcblockd 7 years on

It’s been 7 years since I created and deployed my security automation software on my gateway (which runs FreeBSD). And for the 7th year in a row, the automation is blocking more IP address space from China than any other country.

In other words, China continues to be the most hostile networked country. mcblockd is now blocking port 22 (ssh) from over 151 million IPv4 addresses in China. This isn’t really surprising or even news. Though it would be nice if the general public actually understood the persistent threat before whining that they don’t want TikTok to be divested from ByteDance (noting the legislation that recently passed the House of Representatives in the U.S.). I don’t know how to communicate how much attack traffic originates from China to a person who doesn’t understand IP networking. But I can say that in my own home, not more than a few minutes go by without probe and attack traffic hitting my gateway from China. It’s round the clock. Many users are relatively safe simply because none of their devices are running server software. What they don’t realize is that the probing is constant, and costs all of us bandwidth even if we have no servers at all.

I bring this up because this weekend I did my annual perusal of my web server logs and added a bunch of networks to the list of those I deny. And in the process my average outbound traffic decreased by roughly 500 kilobits/second.

A continuing and growing annoyance that I don’t think our legislators, or for that matter our large hosting services, are minding: it continues to be the case that the bad guys are attacking us from cloud infrastructure, much of it on U.S. soil. It’s clear to me that various entities, since they’re profiting from it, just don’t care. Google, Amazon, Microsoft, DigitalOcean, GoDaddy, Hurricane Electric, PSINet, Cogent, OVH, Hetzner, Linode, others… they’re all used as weapons against our homes and small businesses connected to the Internet. In fact they’re incentivized… having your small business DDoS’ed or penetrated is an argument for moving your Internet services to the cloud.

As an example annoyance, my web site fairly regularly gets hammered from address space owned by ‘FINE GROUP SERVERS LLC’ and ‘TrafficTransitSolution LLC’ which as near as I can tell are shell companies run by the Russian Federation. They utilize a truckload of small address space allocations (nearly all /24), most of which are here in the U.S., to crawl my web site regularly. And some of their infrastructure is a pain in the ass to block because it’s within old PSINet large allocations and not called out in whois or RDAP data.

At any rate, you can see the result of my annual maintenance below. My site was averaging 500 to 600 kilobits/second outbound before I started adding new networks to my block list. I’m now back down to around 100 kilobits/second.

Posted on

My love of mechanical pencils

Admission: I have a fairly large collection of mechanical pencils.

I recently added to my Snoopy collection with more Zebra DelGuard models.

Zebra Delguard limited edition Snoopy pencils, and one older Kuru Toga Snoopy pencil

The DelGuard is my favorite everyday carry. It’s inexpensive but works very well for everyday tasks. If I lose one, no big deal. Another reason I like it is that I’m left-handed. Left handers know we have more lead-breakage issues than right-handers if we’re writing in a western language. We learn to write from left to right, and lefties wind up sort of chiseling into the writing surface. The DelGuard’s lead protection system works better than anything else I’ve used. I have many models of Kuru Toga, but for writing, the DelGuard (including the usual $6 model) is better than any of my Kuru Togas (Standard, Advanced, Pipe Slide, Roulette…). I have many pencils that I enjoy using, but for my everyday use (taking notes, drawing simple diagrams), the DelGuard has been my leading choice for a few years.

Randy and I wound up taking about pencils late one night. His needs are different than mine, which is one of the things that makes these kinds of conversations fun. We both learn something. Randy has some nice Faber Castell wood pencil kits. He said something about some being 15 years old, and I wound up snapping a shot of what I think is the oldest pencil in my everyday carry case. I don’t think it’s my oldest pencil, but it does show some wear and tear. I don’t remember when I got it. From hazy recollection, it was a gift in the early 1990’s. Back when Rotring was still a German company.

It continues to work well despite the mileage. Still a frequent go-to for drawings when I’m using a straight-edge or medium to large stencil.

I’m not going to post a bunch of mechanical pencil pictures.

A related story…

One of my coworkers made an observation during a large group meeting last year. About 20 people in the room. 3 of them with pencil and paper, everyone else with their laptop. The 3 with pencil and paper? The old programmers (he and I included).

And it is funny. I’ve been writing software for over 40 years now. Professionally for over 30 years. I’m far from averse to using computers. I own more than a dozen. Bu† for some things… I still like pencil and paper. Granted, it’s a toss-up between my personal MacBook Pro and pencil+paper for most things. But I generally don’t use my personal laptop at work, and I struggle with the keyboard on the work-assigned laptop. More importantly, it’s often tethered to things that I need to leave running. So… pencil and paper. I enjoy the direct tactile experience of it all. I have an iPad Pro with current generation Apple Pencil, but… it’s not the same and I don’t break it out during meetings.

It made me think… “no batteries required”. Odd? I don’t think so. Just an old skill that some of us keep utilizing because it works for us. Super-low barriers, but more importantly… no distractions. No notifications popping up, no shrinking battery level indicator… 100% of our focus is on the task at hand. I might need a computing device to present something, but I don’t need it to take notes, write down questions to be asked later, etc.

It’s the same reason I still use emacs as my primary code editor. Decades of muscle memory, along with decades of custom elisp accumulation to do things I find useful. I can literally write decent amounts of code with my eyes closed. We may not get super-modern AI features in emacs, but who knows… I said the same thing about useful LSP support in the early days but it works quite well today in the environments I use at home (macOS, FreeBSD, various linux flavors). Until I find an IDE that I can be more productive in, I’ll be using the programmer’s editor created many decades ago but improved and maintained to this day.

Posted on

Making more door moulding: entablatures

I started creating some more door moulding last night. Namely the entablatures for the second floor doorways.

I should note that I love Ken O’Brien’s web site, thejoyofmoldings.com. I’ve used it for inspiration for many years. Check it out, it’s worth it!

I’m a hobbyist woodworker, hence I have enough tools to do a few things myself. I like creating moulding, and it’s relatively easy with a table saw, miter saw and router table with a reasonable router. Ken likes to use MDF, and I do too, because it’s inexpensive and easy to form. The downside is that it’s not terribly durable; it won’t survive dings as well as solid oak (not even close), or even poplar or aspen. I don’t generally worry about such dings, except from vacuums. For that reason, I tend to use red oak shoe moulding, even if I’m going to paint it and use MDF baseboard. But it depends; if it’s simple quarter-round or similar, it can be MDF since I can repair it with Rock Hard Water Putty or even joint compound.

Anyway, my usual entablature at my current home is pretty simple. I start with 3/4″ thick MDF stock, and cut and route two pieces to make the cornice. The top one gets a classical ogie profile, the bottom gets a cove. Yes, I could buy cove moulding, but I find it easier and much nicer-looking to not make separate mitered returns. Here’s a picture of my cornice stack-up, upside down and fresh from the router table. Note that I made this one from finished MDF (intended for shelving) I had on hand instead of the usual primed MDF, hence the thickness to the existing white finish.

I don’t bother to sand at this point, in part because I don’t enjoy sanding bare MDF (it’s not very effective to do so). Instead, I go straight to priming the bare MDF with Zinsser B-I-N, which is shellac with white pigment.

I love Zinsser B-I-N and shellac in general for this purpose. It is a joy to sand, and since it dries incredibly fast, you can start sanding in about 15 minutes (sometimes less) with zero clogging of the sandpaper. I sand lightly with 220 grit, usually the 3M flexible paper (‘Pro Grade Precision Ultra’). Note that shellac sticks to just about everything, and is hence compatible with any paint. I always have Zinsser SealCoat (clear, dewaxed shellac) and Zinsser B-I-N on hand because it’s always part of my finishing process for interior pieces.

With some light sanding, I wind up with something like the photo below, which also has my frieze piece in the stack. The frieze is a single piece of 3/4″ x 3.5″ MDF with a bead routed about 1/2″ from what will be the bottom. Sometimes I create this in 2 pieces and use a bullnose bit to create a piece that’s larger than the frieze (known as ‘necking’), but the bead cut is faster and easier while still adding a nice detail. I’m creating these for 2nd floor hallway doors (three), so I’m OK without necking.

Assembly-wise, I glue and nail (18 gauge pneumatic nailer) the cove piece to the frieze, then glue and nail (again 18 gauge or pin nails) the ogie piece to the cove piece. Installing on the wall is just a matter of nailing through the frieze.

What I like about doing my entablatures in this manner: there are no miter joints to line up, and no miter joints that might separate from temperature and humidity changes. I’ve had entablatures in my home built this way for many years, and none of them have changed in any visible way. They look perfect forever.

Posted on

Office furniture: end tables for the window seat

I completed some end tables for the window seat. Same basic construction as the window seat: solid oak and dowel joinery. The tops have plywood support for the porcelain inserts. The feet are delrin, bolted on with countersunk 5/16″ stainless steel bolts going into threaded inserts in the legs.

Each end table can be latched to the window seat with draw latches that are installed on the underside of the top. When latched, they are VERY stable, basically making the window seat and end tables one large contiguous surface.

I am still waiting for more brown CableDrops from blueLounge, but the intent is to have a Lightning cable and USB-C cable readily accessible at each end of the bench. These run to chargers on the wall beneath the end tables. Right now I only have 20W chargers there, good for tablets or phones. If ever needed, I can swap in beefier chargers for laptops.

I still haven’t ordered a cushion for the window seat.