Migrate to forgejo
In this blog post I explain why I left GitLab and how I moved my repositories and my CI to Forgejo and Forgejo Actions.
2026
Forty-Seven Networks, Sixty-Eight Seconds
47 different chunks of the internet, each a full /24 block of up to 256 addresses, started scanning my infrastructure within 68 seconds of each other. Not 47 individual IPs. 47 entire networks, most of them belonging to a single hosting provider, moving in near-perfect lockstep. 6 months of logs turned up more than a dozen of these synchronized waves, and at least 3 of them weren't one-time events. The same operators came back days later and ran the exact same target list again, like clockwork.
Redtail's Long Runner
Since May, malware hosts have shown up in my honeypot logs, gotten hit once, and disappeared. One host broke that pattern: 217[.]60[.]195[.]113, tied to the Redtail cryptomining botnet, kept getting hit by infected bots for 22.5 days.
Switching from nheinz.dev to nheinz.eu
I recently switched my provider and bought a new domain for my website and hoppy projects: nheinz.eu. For now, a redirect from my old website is in place, but in some couple of months nheinz.dev will be gone.
MDRFCKR - a (almost) decade old botnet
Between May 3 and June 3, 2026, a threat actor operating under the handle "mdrfckr" conducted a sustained SSH credential-stuffing campaign against my internet-facing SSH honeypots. The campaign deployed 3,929 successful authentication events from 1,702 unique source IPs across 32+ countries. Upon gaining access, the attacker deployed a persistent SSH public key bearing the "mdrfckr" comment - a classic botnet recruitment / persistence mechanism.