Niclas Heinz

47 Networks, 68 Seconds

Niclas Heinz — Sat, 05 Sep 2026 09:34:58 +0000

47 Networks, 68 Seconds

47 different chunks of the internet, each a full /24 block of up to 256 addresses, started scanning my infrastructure within 68 seconds of each other. 47 entire networks, most of them belonging to a single hosting provider. 6 months of logs turned up more than a dozen of these synchronized waves, and at least 3 of them weren't one-time events. The same operators came back days later and ran the exact same target list again, like clockwork.

Switching from nheinz.dev to nheinz.eu

Niclas Heinz — Fri, 04 Sep 2026 21:50:43 +0000

Switching from nheinz.dev to nheinz.eu

I recently switched my provider and bought a new domain for my website and hoppy projects: nheinz.eu. For now, a redirect from my old website is in place, but in some couple of months nheinz.dev will be gone.

MDRFCKR - a (almost) decade old botnet

Niclas Heinz — Fri, 04 Sep 2026 21:47:25 +0000

MDRFCKR - a (almost) decade old botnet

Between May 3 and June 3, 2026, a threat actor operating under the handle "mdrfckr" conducted a sustained SSH credential-stuffing campaign against my internet-facing SSH honeypots. The campaign deployed 3,929 successful authentication events from 1,702 unique source IPs across 32+ countries. Upon gaining access, the attacker deployed a persistent SSH public key bearing the "mdrfckr" comment - a classic botnet recruitment / persistence mechanism.

Redtail's Long Runner

Niclas Heinz — Fri, 04 Sep 2026 21:47:25 +0000

Redtail's Long Runner

Since May, malware hosts have shown up in my honeypot logs, gotten hit once, and disappeared. One host broke that pattern: 217[.]60[.]195[.]113, tied to the Redtail cryptomining botnet, kept getting hit by infected bots for 22.5 days.

Deploy Your Material for MkDocs Site on GitLab Pages without unique domains

Niclas Heinz — Fri, 27 Jun 2025 12:57:54 +0000

Deploy Your Material for MkDocs Site on GitLab Pages without unique domains

GitLab Pages is an excellent solution for hosting static websites. Since GitLab 17.4[^1], unique domains are enabled by default for Pages deployments. These domains look like this:
https://website-762e3.gitlab.io/[^2]

However, if you prefer a cleaner URL structure, such as <username>.gitlab.io/<repository>, you need to adjust your configuration.