Mr. Nice Try Notes from the edge

· 4 min read

Ban these networks from your application right now

Four small hosting networks sent 731,906 requests to 3,597 websites in 12 days, and nearly all of them were hunting for .env files, cloud keys and WordPress installs. Here's who they are, the 31 IP ranges to block, and copy-paste rules for Cloudflare, nginx, Caddy and Laravel.

There are four networks on the internet I can't find a single good reason to let into any website.

In the last 12 days they sent 731,906 requests to the 3,597 websites behind the Mr. Nice Try Edge. I went through their traffic looking for anything that looked like a person, or a service you'd want: a search engine, a monitor, a link preview. I found nothing. Between 88% and 98% of what each one asked for was a probe for secrets, and the rest was them checking whether anyone was home.

One of them is the network behind the attack that cold-booted 926 servers on Monday.

On Monday I banned all four from every site on the Edge. Here's the list, so you can do the same.

Mr. Nice Try sets down the last section of a striped road barrier across a street lined with four small warehouses, as little robots pour out of their roller doors and bump into it.

4networks
731,906requests in 12 days
134IPs between them
31IP ranges to block

The four networks

Network ASN Requests IPs Sites hit Probes
TECHOFF SRV LIMITED AS48090 523,225 61 3,039 92%
TC DATACENTER LIMITED AS218785 171,880 40 2,318 88%
Omegatech LTD AS202412 19,070 26 3,568 98%
Bucklog SARL AS211590 17,731 7 14 98%

October 8–19, 2026. "Probes" are requests for paths no real visitor asks for: .env, .git, wp-admin, backups, config files and known exploits.

An ASN (autonomous system number) is a network's ID on the internet. Every IP address belongs to one, and every provider, from Google to a one-room hosting company, has at least one. Ban by ASN, or by the IP ranges it owns, and you've banned the whole network.

TECHOFF SRV LIMITED (AS48090): the WordPress hunter

The busiest of the four: 523,225 requests in 12 days, nearly 44,000 a day. It walks every site looking for a WordPress install in the usual hiding places: /wp/, /blog/, /wordpress/, /cms/, /site/, /news/, /press/. It switches between half a dozen browser names (Chrome on Windows, Chrome on Mac, Safari, Linux), but it connects like a script, not a browser.

TC DATACENTER LIMITED (AS218785): the key thief

This is the one from Monday's attack: 84,161 requests in five minutes from a single IP. Day to day it does the same thing more quietly: /.env in two dozen spellings, /.aws/credentials, backups. It's been at it since at least October 8, from 40 IPs in two blocks, and it introduces itself as Firefox 47, a browser from 2016.

Omegatech LTD (AS202412): a bit of everything

Small, but it visited 3,568 of 3,597 sites, nearly every one. It looks for .env, .git/HEAD (a sign your whole source code is downloadable), database admin panels like adminer.php, and old cgi-bin exploits. Some of its scripts don't even pretend: they call themselves fasthttp.

Bucklog SARL (AS211590): the exploit sender

Only 7 IPs and 14 sites, but they're specific. It runs curl and fires an exploit at an SMTP plugin's REST API (/wp-json/gravitysmtp/…), then tries .env and /login. That's someone working from a list of sites they think are vulnerable.

Ban the network, not the IP

When a bot hits you, the obvious fix is to block its IP. With these four, that does almost nothing.

They rotate. TC DATACENTER used 40 different addresses in 12 days, most of them from one /24 block of 256. Block one and the next request comes from its neighbor. You end up playing whack-a-mole against someone with 255 more moles.

Mr. Nice Try draws a coral loop around one whole block on a neighborhood map while, behind him, a little robot hops from window to window along the same row of houses.

These networks are small. Between them they announce just 31 blocks of 256 addresses. Ban all of them and you've covered every IP they can use today.

How to ban them

Pick whichever matches what sits in front of your app. If more than one does, the one closest to the internet is best: the earlier a request is stopped, the less it costs you.

Cloudflare

If your site is behind Cloudflare, you don't need the IP ranges at all. Cloudflare knows every IP's ASN. Go to Security → WAF → Custom rules, create a rule with this expression, and set the action to Block:

(ip.src.asnum in {218785 48090 202412 211590})

That's it. It covers every IP those networks have now and any they add later.

nginx

Put this inside your server block (or http, for every site on the server), then reload:

# AS218785 TC DATACENTER LIMITED
deny 45.138.12.0/24;
deny 185.218.86.0/24;
# AS48090 TECHOFF SRV LIMITED
deny 45.148.10.0/24;
deny 93.123.109.0/24;
deny 195.178.110.0/24;
# AS202412 Omegatech LTD
deny 45.74.7.0/24;
deny 45.74.57.0/24;
deny 45.74.59.0/24;
deny 45.132.180.0/24;
deny 91.92.240.0/24;
deny 91.92.241.0/24;
deny 91.92.242.0/24;
deny 91.92.243.0/24;
deny 94.26.38.0/24;
deny 94.154.35.0/24;
deny 94.154.40.0/24;
deny 94.154.46.0/24;
deny 104.250.184.0/24;
deny 130.12.180.0/24;
deny 146.19.125.0/24;
deny 158.94.208.0/24;
deny 158.94.209.0/24;
deny 158.94.210.0/24;
deny 158.94.211.0/24;
deny 178.16.52.0/24;
deny 178.16.53.0/24;
deny 178.16.54.0/24;
deny 178.16.55.0/24;
deny 193.30.241.0/24;
# AS211590 Bucklog SARL
deny 170.39.217.0/24;
deny 185.177.72.0/24;

Caddy

@scanners remote_ip 45.74.7.0/24 45.74.57.0/24 45.74.59.0/24 45.132.180.0/24 45.138.12.0/24 45.148.10.0/24 91.92.240.0/24 91.92.241.0/24 91.92.242.0/24 91.92.243.0/24 93.123.109.0/24 94.26.38.0/24 94.154.35.0/24 94.154.40.0/24 94.154.46.0/24 104.250.184.0/24 130.12.180.0/24 146.19.125.0/24 158.94.208.0/24 158.94.209.0/24 158.94.210.0/24 158.94.211.0/24 170.39.217.0/24 178.16.52.0/24 178.16.53.0/24 178.16.54.0/24 178.16.55.0/24 185.177.72.0/24 185.218.86.0/24 193.30.241.0/24 195.178.110.0/24
respond @scanners 403

If Caddy sits behind a load balancer or CDN, use client_ip instead of remote_ip, and set trusted_proxies so Caddy knows the visitor's real IP.

Laravel

A small middleware, using the IP helper Symfony already ships with Laravel:

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;
use Symfony\Component\HttpFoundation\IpUtils;

class BlockScannerNetworks
{
    /**
     * TC DATACENTER (AS218785), TECHOFF SRV (AS48090), Omegatech (AS202412)
     * and Bucklog (AS211590), as announced on October 19, 2026.
     */
    private const RANGES = [
        '45.74.7.0/24',
        '45.74.57.0/24',
        '45.74.59.0/24',
        '45.132.180.0/24',
        '45.138.12.0/24',
        '45.148.10.0/24',
        '91.92.240.0/24',
        '91.92.241.0/24',
        '91.92.242.0/24',
        '91.92.243.0/24',
        '93.123.109.0/24',
        '94.26.38.0/24',
        '94.154.35.0/24',
        '94.154.40.0/24',
        '94.154.46.0/24',
        '104.250.184.0/24',
        '130.12.180.0/24',
        '146.19.125.0/24',
        '158.94.208.0/24',
        '158.94.209.0/24',
        '158.94.210.0/24',
        '158.94.211.0/24',
        '170.39.217.0/24',
        '178.16.52.0/24',
        '178.16.53.0/24',
        '178.16.54.0/24',
        '178.16.55.0/24',
        '185.177.72.0/24',
        '185.218.86.0/24',
        '193.30.241.0/24',
        '195.178.110.0/24',
    ];

    public function handle(Request $request, Closure $next)
    {
        abort_if(IpUtils::checkIp($request->ip(), self::RANGES), 403);

        return $next($request);
    }
}

Register it in bootstrap/app.php with $middleware->prepend(BlockScannerNetworks::class); so it runs before anything else.

Behind a load balancer or CDN, $request->ip() is the proxy's address unless you've told Laravel to trust it, so set up trusted proxies first. And a check in PHP still wakes up PHP. If you're on serverless, that's still a cold boot. Stop them earlier if you can.

Anything else

Here are all 31 ranges as a plain list, for a firewall, a security group, an AWS WAF IP set or anything else that takes CIDRs:

# AS218785 TC DATACENTER LIMITED
45.138.12.0/24
185.218.86.0/24
# AS48090 TECHOFF SRV LIMITED
45.148.10.0/24
93.123.109.0/24
195.178.110.0/24
# AS202412 Omegatech LTD
45.74.7.0/24
45.74.57.0/24
45.74.59.0/24
45.132.180.0/24
91.92.240.0/24
91.92.241.0/24
91.92.242.0/24
91.92.243.0/24
94.26.38.0/24
94.154.35.0/24
94.154.40.0/24
94.154.46.0/24
104.250.184.0/24
130.12.180.0/24
146.19.125.0/24
158.94.208.0/24
158.94.209.0/24
158.94.210.0/24
158.94.211.0/24
178.16.52.0/24
178.16.53.0/24
178.16.54.0/24
178.16.55.0/24
193.30.241.0/24
# AS211590 Bucklog SARL
170.39.217.0/24
185.177.72.0/24

Keep the list fresh

These ranges are what the four networks announced on October 19, 2026, from RIPE's public routing data. Networks buy, sell and shuffle address space, so a list like this goes stale. Ban by ASN where you can (Cloudflare does it for you). Where you can't, look the ranges up again every month or so:

https://stat.ripe.net/data/announced-prefixes/data.json?resource=AS218785

Swap in each ASN. It's free and needs no account.

What I didn't ban: Google Cloud

The biggest source of probes I see isn't on this list. Google Cloud (AS396982) sent 4.3 million requests in the last week, and in each of the 25 countries that sent the most, 93–100% of them were probes. Belgium alone sent 1.5 million.

But you can't ban all of it. Real services you'd want run there, like what looks like the fetcher Claude uses when someone asks it to read your page, and page-speed testers. (Googlebot itself is on a different network, AS15169, so it wouldn't be affected either way.)

What stood out is where those good services were: every one I found was in the US. Outside the US, the Google Cloud IPs that never asked for a probe sent about 3,500 requests in a whole week, between Scrapy, a few Python scripts and one indexing bot. So if your visitors don't reach you through Google Cloud from outside the US, blocking ip.src.asnum eq 396982 and ip.src.country ne "US" gets rid of most of the noise. Otherwise, block it by behaviour: anyone who asks for /.env has told you everything you need to know.

The short version

  • Ban these four networks today: AS218785, AS48090, AS202412 and AS211590. Nothing good comes from them.
  • Ban the network, not the IP. They rotate inside their blocks.
  • Ban by ASN if your edge supports it, or use the 31 ranges above and refresh them monthly.
  • Stop them as early as you can. A 403 from your CDN costs nothing. The same 403 from your app still boots a server.
  • And still don't leave anything to find. A ban list only ever covers the bots you already know about.

I'm watching what knocks on 3,597 websites every day. If you want to hear about the next network worth banning, I'm @MrNiceTry on X.