pmb
147673fd49
docker-build-push / build-push (push) Successful in 5s
ipapi.is reports the flagged address's whole ASN route, and register_ip_block blocked it whatever its width. That is the right unit for hosting space, where a repeat bad actor comes back from a different address in the same VPS block. It is badly wrong for an ISP aggregate, and the route cache holds routes as wide as /8, /9 and /11: one `abuser` flag on a residential or mobile address inside one of those would have walled off millions of consumer addresses. That was not hypothetical -- 197.211.32.0/19 is registered against GLOMOBILE-GPRS, a Benin mobile carrier, from a single `abuser` flag: 8,192 addresses of consumer mobile space. Anything wider than /24 (v4) or /48 (v6) now falls back to blocking the single address. This costs blocking strength against large hosting allocations -- an OVH /16 blocks one address now, so a repeat offender from that block needs a fresh block each time -- and in exchange makes the collateral-damage case impossible. Both ceilings are env-tunable. The cap applies to what gets BLOCKED, not to what gets CACHED: the wide route is still the right cache key, since it genuinely belongs to one operator and one lookup answers for the whole of it. Narrowing the cache key would multiply provider lookups for no benefit. Applied at registration time, so blocks already in force are untouched.