Schwim Dandy

  • 1 Post
  • 34 Comments
Joined 6 months ago
cake
Cake day: March 28th, 2024

help-circle



  • That might not work either. If a server marks it as spam, we do something called blackholing the email, meaning we discard the email and close the connection without responding to the sending server. This is done in an effort to provide as little info as possible to a bad actor.

    If you don’t send an email from a server and address deemed reputable and with a low enough spam score, you’ll be shut down by more than 95% of the mail servers out there.


  • There’s really not enough info here to help you. Are you looking for software? Writing it from scratch? Web tool? Bulk or not?

    I don’t know how many addresses you plan on testing on any one server but we’ve been on to this trick for decades now and the firewall will block you from almost every server once you try a non-existent address a few times(for my servers, it’s 2). Many servers also report bot/spam IPs to the ISP and if you get reported enough time, your connection could get shut down.







  • Thanks very much, I believe I understand that part now, like a fingerprint to associate to site components like pulled in js, css, etc. I still don’t understand, though, how they associate that to a particular user of a VPN. Does each request done through a VPN include some sort of identifier for each of us or is AI also doing something to put these requests in a particular user’s bucket?







  • I do this for part of my reg forms. I split the reg process into two parts. First, supply email only. This element uses an obfuscated id. Once they do that, the link sent to their email leads to the rest of the process, using no obfuscation. This should keep from breaking password managers.

    Regarding login bruteforcing. I give them 3 shots then a cooling down period.

    This process has resulted in a 0% success rate for bots so far. We will see how it holds as the domain sees more traffic.