Login
You're viewing the sfba.social public feed.
  • Aug 1, 2026, 6:21 AM

    @alesroubicek @beeoproblem @sammypanda @mattly I'd like to see the residential ISPs detect this sort of thing and throttle the customers to about 56K until they remove whatever is hosting the malware.

    Either that or there needs to be a Spamhaus-like blocking service so the customers are denied access to pretty much everything. Put the problem back on the fool who is running a Kodi box (or a Walmart special TV, not much difference.)

    Have you found a good way to block this stuff?

    💬 4🔄 0⭐ 5

Replies

  • 💬 0🔄 0⭐ 1
  • Aug 1, 2026, 7:00 AM

    @mike805 if you find it useful, I use go-away (git.gammaspectra.live/git/go-a), rules ramped up for checks on blog posts that usually cans out the bots. On the firewall I also pull a blocklist from AbuseIPDB.com, for the most part it will catch scrapers in the net.

    I've not yet worked out a way to calculate failed challenges for an IP then report them in to AbuseIPDB from go-away to rat on them

    💬 0🔄 0⭐ 1
  • Aug 1, 2026, 12:13 PM

    @mike805 Do you you have a reference how Kodi is affected by this botnet/proxy topic?

    💬 1🔄 0⭐ 0
  • 💬 1🔄 1⭐ 1
  • 💬 1🔄 0⭐ 0
  • Aug 1, 2026, 9:02 PM

    @6N3my6 These TV boxes almost all use Kodi as the basic user interface, and are sometimes generically called "Kodi boxes." They are generic Android platforms that often come preloaded with (or download on first use) a bunch of pirate streaming apps. Many of them also come preloaded with residential proxy malware.

    No insult to Kodi as a project intended.

    💬 1🔄 0⭐ 2
  • Aug 2, 2026, 3:37 AM

    @mike805 Now that makes it clear to me, thank you. Wasn't aware some of these pre-configured boxes are based on Kodi.

    💬 0🔄 1⭐ 1
  • Aug 1, 2026, 9:33 PM

    @mike805 @alesroubicek @beeoproblem @mattly absolutely! my shower thought was how ISPs are majorly guilty for the issue. Bad oversight, ISP culture that doesn't care about IP reputation for some reason, CGNAT and anything else that allows IPs to be so ephemeral when they were really supposed to be... an address to you, but now they might as well just be considered purely for routing having been all been rentified. Also IANA doing nothing too. Without proactiveness on the issue IPv6 will be used exactly like this enshitifed IPv4 and that would be catastrophic.. an unbelievable amount of IPs to just cycle around and be careless with. It should be a way bigger concern for IANA, ISPs and governments that IPs are not doing what is on the can by the person they are rented to. There should be something to indicate that traffic is behind a proxy, something like the ISP/router could put a proxied traffic likely flag if there is incoming connections that match the volume of outgoing from the local ip it's assigned to + ways to prove that pattern is something other than a proxy if the user doesn't want the mark on their outgoing. But, there is really barely anything like that in the core design, it's all still pretending like there's only 1000 people on the internet lol; deferring all the reputation and usability of the internet to downstream services $$$, dynamic lists, cloudflare: lord of the modern internet, and the application layer. Rant +1

    💬 0🔄 0⭐ 0