Skip to content
FeaturesPricingAffiliateBlogHelpAboutContact
Get StartedSign In
Back to Blog
industry2026-05-237 min read

"We banned the attacker's IP and they kept coming back" — defeating 18 quintillion IPv6 addresses with a /64 bucket collapse

Mikael (33), reliability engineer in Stockholm, banned 32 IPv6 addresses across 4 Tuesdays for a single restaurant customer; each ban was defeated by a fresh interface ID. All 32 lived in the same /64. PR #598 batch AAA F2: shared collapseToBucket() helper + 13 vitest contract tests pin the abuse-mitigation invariant. The Cloudflare WAF / AWS Shield / reCAPTCHA standard pattern arrives at thMenu.

th

thMenu Team

thmenu.com

Found this helpful? Share it.

Related articles

✦📈
industry

Why Digital Menus Increase Restaurant Revenue by Up to 30%

Studies show restaurants using digital QR menus see measurable increases in aver…

✦🔻
industry

When a Customer Downgrades, What Happens to Old Features? — The Silent Feature-Drift Problem in SaaS

Most SaaS apps run a single line of code when a customer downgrades — but old fe…

✦🛡️
industry

JWT alg-confusion attack — why Supabase's HS256 → RS256/JWKS migration breaks legacy verifiers

Verifiers that never decode the JWT header are wide open to `alg=none` and alg-c…