After cca 3 years of struggling with botnet, registering fake accounts on our instance, I finally started to play with some internet security basics.
The first free blocklist I stumbled upon was
https://github.com/stamparm/ipsum - because web sites with fancy graphics seem to offer just few free queries and then ask for money (the security game is about money, just like advertising and spam... maybe even more so). The blocklist seems to be mostly list of tor exit nodes and known hacked routers.
Surprisingly, almost all IP addresses where the fake accounts came from were on this list. And in few cases, when won't, the subnet pattern was obvious and my malicious IP was the one the few, which were missing from mapped subnet. So automatic conversion of the ipsum.txt file to list of obvious malicious subnets may be nice challenge for former programmer, like me...
There is API for maintaining Mastodon instance IP block list, but it is just like with closing the registrations (registration approval won't stop bots from attempting). There would be still some chance, that some IPs on the list are by mistake. So I am mostly using the list to verify manual blocking, for now.
Basically, any security based on centrally maintained block lists is doomed by default. It would be nice, if Mastodon (or other future, better Fediverse software) can federate IP blocklist of instances which trust each other, so we can crowdsource the hard work.
#mastodon #ipblock #blocklist #ipsum #tor
