Join Nostr
2026-09-11 16:22:45 UTC

:rainbowCrow: on Nostr: RE: Here are the IPv6 prefixes in case you need them: > 2406:840:e351::/48 > ...

RE: https://infosec.exchange/@cR0w/117253229185589027

Here are the IPv6 prefixes in case you need them:

> 2406:840:e351::/48
> 2406:840:e354::/48
> 2406:840:e35d::/48
> 2604:4d40:2000::/36
> 2605:6400:1::/48
> 2605:6400:2::/48
> 2605:6400:3::/48
> 2605:6400:10::/48
> 2605:6400:20::/48
> 2605:6400:30::/48
> 2605:6400:40::/48
> 2605:6400:300::/48
> 2605:6400:1001::/48
> 2605:6400:1002::/48
> 2605:6400:1003::/48
> 2605:6400:1004::/48
> 2605:6400:4000::/34
> 2605:6400:8000::/34
> 2605:6400:9001::/48
> 2605:6400:9002::/48
> 2605:6400:9003::/48
> 2605:6400:c000::/34
> 2605:6404::/32
> 2a09:7500::/29
> 2a0f:3044::/32
> 2a0f:7d05::/32
> 2a10:fa81:1200::/40
> 2a11:2304::/37
> 2a14:7580:e451::/48
> 2a14:7580:e4d0::/48
> 2a14:7581:d101::/48
> 2a14:7581:d102::/48
> 2a14:7581:d103::/48
> 2a14:7581:d104::/48

But I'm mostly seeing ( a lot of ) shit from 2605:6400::/28.
quoting

Naughty ASN of the day: AS53667 ( again )

Maybe do some hunting for their IPv6 prefixes in your auth logs, especially for O365 / M365 / Azure / Entra / whatever that shit is called these days.
Author Public Key
npub1s6eewzr2zvz3ppsa6k8j2hadamsug7q4rp068wmz3grtf440xxkqr8n008