pmb
233458d6b8
docker-build-push / build-push (push) Successful in 24s
A /32 block is close to useless against what IP scrutiny fires on: a datacenter/VPN/proxy customer has the rest of the range sitting right there, so blocking the single address we saw stops nothing the same actor does a minute later from the address next door. The width ceiling added 2026-09-13 made this the common case rather than the exception: its fallback for an over-wide ASN route was the bare address, so a flagged signup out of a /18 hosting allocation got a /32. Add IP_SCRUTINY_MIN_BLOCK_PREFIX_V4/_V6 (24/48) as a floor under that ceiling. Anything narrower than the floor -- a missing route, the /32 recorded when a route didn't contain the IP, a small hosting allocation, or the fallback from a route wider than the ceiling -- is widened to the network of that width containing the address. At the defaults the floor equals the ceiling, so every v4 block is now exactly the /24 containing the flagged address. State the collateral cost rather than waving at it: at the live settings (sign_up_block severity, ~30d expiry) one flagged signup now hard-refuses registration from 256 addresses for a month. Moving the severity to sign_up_requires_approval or shortening the expiry buys that back, and setting the floor to 32/128 restores the old behaviour entirely.