2026-08-21 02:06 UTC
@jerry@infosec.exchange @silhouette@dumbfuckingweb.site do the waves come from any isps or multiple signups from the same host? i get there are residential proxies in use, but im wondering if theres enough volume to spot patterns. or like, web/appserver logs from the same ip - do they do recon before signing up in a way that can get fingerprinted
Replies (1)
-
@jerry@infosec.exchange 2026-08-21 02:09
@Viss@mastodon.social @silhouette@dumbfuckingweb.site residential US IP addresses, tor exit nodes, and lately protonvpn. They have figured out how to mass create proton accounts because the last few day, protonmail.com and protonvpn IPs have become the strongest signal of a bot (but it’s also used by a lot of legit people)