Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.


freitasm

BDFL - Memuneh
81371 posts

Uber Geek
+1 received by user: 42732

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

#324953 18-Jun-2026 14:42
Send private message quote this post

Over the last few hours, we've seen an increase in requests from New Zealand ISPs.

 

For comparison, here's the last seven days of requests to Geekzone. You can see the unusual increase today:

 

 

These are the top five ISPs during the period from 6AM to 2PM today:

 

 

The top three seem to always be in that position, being the largest ISPs in the country. But this seems to be seven times more requests than usual for the same period in other days.

 

Then Mercury and Starlink appear, when they usually are just a blip.

 

Looking at the traffic and the IP address distribution, I believe there is a bunch of compromised devices in New Zealand, probably the usual suspects: malware-infested Android streaming boxes bought from AliExpress and cheap routers. These are usually remote-controlled and rented out to companies (good or bad) wanting to use residential IPs to crawl websites or initiate an attack.

 

So I've enabled captchas on Geekzone. Blame the people who plug these devices into the network.





Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies 

 

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

 

 

LEGAL video, movies and TV download and streaming options in New Zealand


View this topic in a long page with up to 500 replies per page Create new topic
 1 | 2
freitasm

BDFL - Memuneh
81371 posts

Uber Geek
+1 received by user: 42732

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #3504793 20-Jun-2026 10:08
Send private message quote this post

This is a chart for the last seven days, direct from our logs (not from Cloudflare). You can see the New Zealand traffic around 18 June is not the largest one, with a spike 13 June that was much larger. That previous spike was not driven from New Zealand IP addresses.

 





Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies 

 

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

 

 

LEGAL video, movies and TV download and streaming options in New Zealand




boosacnoodle
1555 posts

Uber Geek
+1 received by user: 1033


  #3504825 20-Jun-2026 12:33
Send private message quote this post

Aren't you using Cloudflare? Shouldn't they be picking this up automatically? Either way, it's really odd.


freitasm

BDFL - Memuneh
81371 posts

Uber Geek
+1 received by user: 42732

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #3504881 20-Jun-2026 12:54
Send private message quote this post

boosacnoodle:

 

Aren't you using Cloudflare? Shouldn't they be picking this up automatically? Either way, it's really odd.

 

 

Yes, and no.

 

It's not a DDoS. It's coming from multiple different IP addresses, and it doesn't look like bot traffic. So I set up Cloudflare custom rules to filter traffic based on a set of conditions unique to Geekzone. That's why the spikes disappear.





Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies 

 

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

 

 

LEGAL video, movies and TV download and streaming options in New Zealand




geek3001
556 posts

Ultimate Geek
+1 received by user: 970

ID Verified
Subscriber

  #3504978 21-Jun-2026 09:09
Send private message quote this post

All good.

 

The Capture process seems to add barely a second to the initial connection to the site while it decides whether it likes me or not.


Tinkerisk
4974 posts

Uber Geek
+1 received by user: 3935


  #3505106 21-Jun-2026 18:44
Send private message quote this post

edit: wrong category





     

  • Qui nihil scit, omnia credere debet. - He who knows nothing must believe everything.
  • Firewalls do NOT stop dragons. Really not. But your smart devices are spying on you!
  • I avoid Big Tech amap. They try hard to dictate technology and „culture“ across borders.
  • In effect we have everything to hide from someone, and no idea who „someone“ is.

richms
29594 posts

Uber Geek
+1 received by user: 10633

Trusted
Lifetime subscriber

  #3505108 21-Jun-2026 18:51
Send private message quote this post

Do you know what device it is that is doing it yet? I have extensive chinese tat on my connection here and have not had any captcha issues.





Richard rich.ms

 
 
 
 

Shop now for Lego sets and other gifts (affiliate link).
freitasm

BDFL - Memuneh
81371 posts

Uber Geek
+1 received by user: 42732

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #3505109 21-Jun-2026 18:59
Send private message quote this post

We are not doing captchas for specific devices or connections. But there's a chance that any China-sourced streamer will have malware installed from the origin. Check the link I posted in the OP. 





Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies 

 

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

 

 

LEGAL video, movies and TV download and streaming options in New Zealand


turtleattacks
1039 posts

Uber Geek
+1 received by user: 314

Trusted

  #3505110 21-Jun-2026 19:19
Send private message quote this post

This is a worthy watch. https://www.youtube.com/watch?v=apEPPKYgLL0

 

TL:DW: Streaming or photo frame devices may be infected with malware. 





insane
3347 posts

Uber Geek
+1 received by user: 1023

ID Verified
Trusted
2degrees
Subscriber

  #3505111 21-Jun-2026 19:36
Send private message quote this post

It's not something like Sam knows or similar monitoring system now running a check or crawl of GZ?

 

Can you see the user agent?


freitasm

BDFL - Memuneh
81371 posts

Uber Geek
+1 received by user: 42732

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #3505112 21-Jun-2026 19:38
Send private message quote this post

The volume of requests, variety of IPs, the clustering around a few ISPs and the consistent use of standard User Agents indicate these are likely compromised devices.

 

Again based on volume it's more likely routers or streaming boxes. I don't believe there are enough photo frames in New Zealand to justify this spread.





Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies 

 

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

 

 

LEGAL video, movies and TV download and streaming options in New Zealand


nztim
4148 posts

Uber Geek
+1 received by user: 2876

ID Verified
Trusted
TEAMnetwork
Subscriber

  #3505115 21-Jun-2026 20:12
Send private message quote this post

This is when been on a smaller ISP helps I am with Sky (Hybrid resold 2degrees with their own ASN) not had a challenge





Any views expressed on these forums are my own and don't necessarily reflect those of my employer. 


HP

 
 
 
 

Shop now for HP laptops and other devices (affiliate link).
freitasm

BDFL - Memuneh
81371 posts

Uber Geek
+1 received by user: 42732

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #3505116 21-Jun-2026 20:32
Send private message quote this post

Nothing to do with ISP. There are conditions in place.





Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies 

 

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

 

 

LEGAL video, movies and TV download and streaming options in New Zealand


MikeAqua
8756 posts

Uber Geek
+1 received by user: 4355


  #3505154 22-Jun-2026 10:01
Send private message quote this post

freitasm:

 

But there's a chance that any China-sourced streamer will have malware installed from the origin. 

 

 

Or trains apparently.





Mike


freitasm

BDFL - Memuneh
81371 posts

Uber Geek
+1 received by user: 42732

Administrator
ID Verified
Trusted
Geekzone
Lifetime subscriber

  #3505457 23-Jun-2026 13:50
Send private message quote this post

freitasm:

 

Looking at the traffic and the IP address distribution, I believe there is a bunch of compromised devices in New Zealand, probably the usual suspects: malware-infested Android streaming boxes bought from AliExpress and cheap routers. These are usually remote-controlled and rented out to companies (good or bad) wanting to use residential IPs to crawl websites or initiate an attack.

 

 

And it's not only routers or Android streaming boxes.

 

Nearly Half of LG Smart TV Apps Contain Residential Proxy SDKs

 

 

Some apps make the trade-off even more explicit. Pac-Man on Tizen frames Bright Data as the ad-free option: decline and you keep the ad-supported game, accept and the app gets to use the TV's connection for web indexing. That is a clean little monetization fork: watch ads or become part of the proxy network.

 





Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies 

 

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

 

 

LEGAL video, movies and TV download and streaming options in New Zealand


Tinkerisk
4974 posts

Uber Geek
+1 received by user: 3935


  #3505675 24-Jun-2026 04:37
Send private message quote this post

@freitasm What surprises me is why they started up so suddenly. Can you tell if this is happening in a coordinated way?





     

  • Qui nihil scit, omnia credere debet. - He who knows nothing must believe everything.
  • Firewalls do NOT stop dragons. Really not. But your smart devices are spying on you!
  • I avoid Big Tech amap. They try hard to dictate technology and „culture“ across borders.
  • In effect we have everything to hide from someone, and no idea who „someone“ is.

 1 | 2
View this topic in a long page with up to 500 replies per page Create new topic









Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.