There is a bomb deeply hidden in the kernel that will destroy 84% of corporate databases and nearly all governmental databases when detonated. Black block sappers are tunneling their way in to find triggers left by developers who didn't trust the VCs who funded them. The current oppression will only end when the billionaires lose their power, when they lose their billions. A capital-destroying logic bomb would be less harmful than looming economic disaster or bloody pitchforks. Or not. In any case, that isn't what this page is about. Its about much smaller breakage.
We break the interenet by sending much incoming traffic to an oubliette or the rack. The oubliette drops connections (in the raw chain of the PREROUTING table). The rack accepts SMTP connections, any senders and any recipients, but then rudely 551 rejects the message. We lie to listwashers, inducing them to add us to their don't bother list.
We drop legitimate scans into the oubliette. It is full of ether, and offers a far gentler end than facing the rack. The hacker/bots that do may be treated poorly and lied to.
Nearly all Microsoft probes during the past couple of weeks came from named hosts: of 958 probes, 952 came from 952 hosts named azpd????????.stretchoid.com, while the remaining 6 came from IP addresses that did not reverse. Many IPs that now reverse did not do so when originally checked, shortly after they sent us packets. That might happen if these hosts are newly created, were assigned names at creation, but those names had not yet propagated when checked initially. Propagation might be slow within Microsoft.
31 March 2026
Stretchoid keeps moving to new hosts while abandoning old ones. We inspected rDNS for all /24 networks that include known stretchoid
hosts again, finding about 160 that were not stetchoid.com, azure.net or turbify.biz. Hosts belonging to mailmarshal.cloud and associated
twsegcloud.com stand out in newly discovered /24s. The 160 hosts resolved to 110 IPs, which we whitelist. They have received nothing on port 25 to date.
13 September 2026
While Microsoft shows a webpage for its scanner, it does not tell us where its scans originate. The DNS gives hostnames for most, but not all of their scanners, leaving us unable to clearly identify their traffic. We now monitor and drop traffic from any /18 containing stretchoid.com hosts, and will soon begin treating all traffic from these /18s as coming from bots/hackers.
Stretchoid's bad reputation is well deserved. They constantly rotate hostnames in shame. One wonders how many of the named hosts in these blocks are fake; all the traffic we see from these /18s are from *.stretchoid.com and NXDOMAIN.
We dislike breaking the internet this way (we like breaking it in others), by listing /18s. It applies a single label to all hosts within a network. We have seen mail servers listed along with the rest of a /24 because of bad neighbors. It was unfair. But behind Stretchoid stands Microsoft in all its brute power, in vast ipv4 address spaces they control, with not a human in sight. Monitor and drop.
29 September 2026
September 30 marked the end of a calendar quarter, and a change in stretchoid's behavior. Volume of probes fell then rebounded, but more interestingly, only about 10% of scans now come from named hosts, contrasting with the 60-70% observed earlier. Named stretchoid hosts now represent a small portion of the scanner space, and blocklists that rely on these names may be ineffective. Perhaps this is temporary, but it pushes us to treat these sources as hackers.
2 October 2026
We get no legitimate mail from hosts whose rDNS points to *.bc.googleusercontent.com. We will treat connections from these hosts as bot/hacker piss, but frequent, diverse port scans suggest it includes "dark" scanners, likely run by the evil ones themselves. Nearly all scans from these hosts stopped for a few hours on September 30, at the end of the calendar quarter, which rather suggests these scans come from a single organization.
It isn't hard to imagine a world in which all the monsters have scanners. AWS could easily run one for the lizard. Dark scanners will be treated as bots/hackers.
We monitor and drop everything coming from