Post by @jerry@infosec.exchange

2026-08-21 02:09 UTC

@Viss@mastodon.social @silhouette@dumbfuckingweb.site residential US IP addresses, tor exit nodes, and lately protonvpn. They have figured out how to mass create proton accounts because the last few day, protonmail.com and protonvpn IPs have become the strongest signal of a bot (but it’s also used by a lot of legit people)

Replies (4)

@gnyman@infosec.exchange 2026-08-27 05:48

@jerry@infosec.exchange have you considered using @greynoise@infosec.exchange as a signal? Seems like that would be useful and maybe they would be willing to provide it pro-bono for the benefit of the community?

Open ##4550651
@Viss@mastodon.social 2026-08-21 02:09

@jerry@infosec.exchange @silhouette@dumbfuckingweb.site see you think notifying proton would have some effect but the news coming out of that place telegraphs 'they really dont care so long as the checks are clearing and they dont get creditcard chargebacks'

Open ##5078011
@EdBruce@infosec.exchange 2026-08-21 14:22

@jerry@infosec.exchange @Viss@mastodon.social @silhouette@dumbfuckingweb.site Well that explains why I'm getting blocked all the time. I use ProtonVPN now and again. Been using a residential proxy also. But even when using my actual IP now getting blocked.

Open ##5078021
@silhouette@dumbfuckingweb.site 2026-08-21 18:38

@jerry@infosec.exchange @Viss@mastodon.social like this one came in yesterday for example. Looks like a spam network, has an AbuseIPDB rating too. Haven't done any data correlation yet but ProtonVPN/Proxy sources seem to be in the majority. Not censoring the IP because fuck it.

Open ##5078024