You're viewing the dementedandsadbut.social public feed.

Federated feed Local feed

MissConstrueMissConstrue@mefi.social
Oct 24, 2026, 9:25 PM
So, I’ve mentioned before that I have a site I’ve had since 1995 that I had to strip down to a single page because a Chinese company started using my name, but seems to have no interest in buying the domain.
I tell you that story only to tell you this one, I’ve been hit over 50,000 times with ai bots in the last 12 hours. They’re doing lateral path searches, like /etc/passwd and /etc/shadow, and just pounding SSH. (HP1 has been slurped, confirmed.)
Anyway, if your #server has #bandwidth limits, now is a good time to check on those.
#infosec #sysop #StupidestTimelineEver
💬 5🔄 18⭐ 23

Replies

Abram Kedge🏴󠁧󠁢󠁳󠁣󠁴󠁿🇨🇦AbramKedge@beige.party
Oct 24, 2026, 9:50 PM
@MissConstrue if you've got access, fail2ban is very effective, and kind of fun to tweak to close out bad actors quickly. My sites were always getting trawled by bots trying to exploit WordPress vulnerabilities. Now I let them try three WP addresses before they get dumped in the sin-bin.
💬 2🔄 0⭐ 4
Carsten Frankecarstenfranke@mastodon.social
Oct 24, 2026, 10:00 PM
@AbramKedge
Oh, I did not know that, I only use it for login attempts. Need to look at failed site calls. Thanks for mentioning this!
@MissConstrue
💬 1🔄 0⭐ 2
James Brittjamesbritt@mastodon.social
Oct 25, 2026, 1:51 AM
@carstenfranke @AbramKedge @MissConstrue
I periodically check my site logs and note all the presumed (but nonexistent on my site) pages attempted. Then add the paths to fail2ban.
💬 0🔄 0⭐ 1
MissConstrueMissConstrue@mefi.social
Oct 25, 2026, 8:07 AM
@AbramKedge Sorry, Thought I replied to this earlier, but yes, that is the plan.
💬 0🔄 0⭐ 0
aneelaneel@mefi.social
Oct 24, 2026, 10:57 PM
@MissConstrue I wrote a cgi script that translates web pages into pikachu speak back around the turn of the century, and the VPS that hosts it has been at 100% CPU for weeks now. I hope the clankers are learning a lot!
💬 1🔄 1⭐ 7
aneelaneel@mefi.social
Oct 25, 2026, 3:54 AM
@MissConstrue Wow, this is really doing numbers! (6). Check out my SoundCloud… err… cgi script. https://pikachizer.eye-of-newt.com j/k, you’ll get a 429 error.
💬 0🔄 0⭐ 0
Robin Bradshawen4rab@infosec.exchange
Oct 24, 2026, 11:22 PM
@MissConstrue
RewriteEngine On
RewriteCond %{REQUEST_URI} \.php [NC]
RewriteRule ^ http://www.youtube.com/watch?v=dQw4w9WgXcQ [R=301,L,QSD]
💬 0🔄 0⭐ 3
MissConstrueMissConstrue@mefi.social
Oct 25, 2026, 1:40 AM
@en4rab Funny. ;)
💬 0🔄 0⭐ 0
Mark Harrisnzlemming@mastodon.nz
Oct 25, 2026, 7:33 AM
@MissConstrue I have postponed setting up a planned website purely because of the potential for excessive charges due to AI scraping.
💬 1🔄 0⭐ 0
MissConstrueMissConstrue@mefi.social
Oct 25, 2026, 8:06 AM
@nzlemming Agree, I’m taking all of my hobby sites down for the same reasons.
💬 0🔄 0⭐ 0
Daniel Bairddjb@social.shirow.net
Oct 25, 2026, 8:37 AM
@MissConstrue @bms I’m loving fail2ban more than ever. The NGINX invalid request module kicks arse. The ssh failed login gets a really long ban.
💬 0🔄 0⭐ 0