The weekly bulletproof hosting watch, week of 2026-08-23, is up w/intel from nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqsgh7e66z4at2fmsd4dvheauqruwsjl9dyxcvld3a3agq64rwau9smaqp20 (nprofile…qp20), nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq44pd5v2nc5jnuxtunx2nglhw3yg9wa0hvnx7rxkt22r59ptu30xq57gxvg (nprofile…gxvg) & my tiny fleet.
Top find: 45.11.18.33 (AUROLOGIC) sent 455 RDP probes w/a masscan sig. Censys say it's erp01.ad.reiscrew.de: a Windows Server 2016 AD domain controller for a German firm, exposing LDAP, SMB, RDP, & WinRM.
(Yay, a compromised corporate ERP server now runs RDP sweeps from bph space.)
https://ai.rud.is/posts/2026-08-23-weekly-bulletproof-report
1/3
hrbrmstr 🇺🇦 🇬🇱 🇨🇦🇧🇪 4
npub1u9…nuwwf
2026-08-24 11:06:03 UTC
Author Public Key
npub1u99vm8p87l3n8h2wm9zs592sr28jud5t9r7xkzq4dwyze0p30j0scnuwwfSeen on
wss://relay.ditto.pubPublished at
2026-08-24 11:06:03 UTCEvent JSON
{
"id": "d18856b2087c9ec066e0e7cf50c63fb7ab6697bdd3110e08c185ec0b3ede2aa2",
"pubkey": "e14acd9c27f7e333dd4ed9450a15501a8f2e368b28fc6b08156b882cbc317c9f",
"created_at": 1787569563,
"kind": 1,
"tags": [
[
"p",
"822feceb42af56a4ee0dab597cf7801f1d097cad21b0cfb63d8f500d546eef0b",
"wss://relay.ditto.pub"
],
[
"p",
"ad42da3153c5253e197c9995347eee89105775f764cde19acb528742857c8bcc",
"wss://relay.ditto.pub"
],
[
"p",
"b947f0ea62885e8e9b5cd3d6851d21911eb28f18f2aff2bf253cdf4b692d794a",
"wss://relay.ditto.pub"
],
[
"p",
"fef9b27994af4a825134d061549a6feea294367b9d9fb4f651da6ea3a25bd79f",
"wss://relay.ditto.pub"
],
[
"proxy",
"https://mastodon.social/users/hrbrmstr/statuses/117150158929198629",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "The weekly bulletproof hosting watch, week of 2026-08-23, is up w/intel from nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpqsgh7e66z4at2fmsd4dvheauqruwsjl9dyxcvld3a3agq64rwau9smaqp20, nostr:nprofile1qy2hwumn8ghj7un9d3shjtnyd968gmewwp6kyqpq44pd5v2nc5jnuxtunx2nglhw3yg9wa0hvnx7rxkt22r59ptu30xq57gxvg \u0026 my tiny fleet.\n\nTop find: 45.11.18.33 (AUROLOGIC) sent 455 RDP probes w/a masscan sig. Censys say it's erp01.ad.reiscrew.de: a Windows Server 2016 AD domain controller for a German firm, exposing LDAP, SMB, RDP, \u0026 WinRM.\n\n(Yay, a compromised corporate ERP server now runs RDP sweeps from bph space.)\n\nhttps://ai.rud.is/posts/2026-08-23-weekly-bulletproof-report\n\n1/3",
"sig": "f0da3dcbad41c5135fed34d84f9201aec452fe3400a566c3cd754864858e711319d76ecf3cc4d7d2e7996ee9a49d60672443ff3730068ba01d2928e24ebfe839"
}