statistics:
hits 1037549
after filter 13530
bot rate 98.70%
addrs filtered 6018
UAs filtered 225
paths filtered 1566

something something dead internet theory

got another few valid hits on my bitflip experiment:
statistics:
hits 53731
after filter 19
bot rate 99.96%
addrs filtered 200
UAs filtered 8
paths filtered 86

new hits:
- one from an Android 9 device on Rogers (ipv6) using gmail webview
- 4 from google-owned IPs(!): three tracking pixels from blogger domains, and one pagespeed proxy request

I am slightly intrigued by the google IPs - do they run a lot of gear without ECC memory?

@astraleureka Just guessing, but Google’s hardware engineering MO for a long while was “buy the cheapest hardware and flog it to death”. Someone else would have to tell you how true that is nowadays, but I wouldn’t be surprised if they’ve spared the expense of ECC.
DEFCON 19: Bit-squatting: DNS Hijacking Without Exploitation (w speaker)

YouTube

@cursedsql @bytex64 yeah, I am effectively re-running these same experiments (although I can't afford the full set of domains quite yet) to see what's different in the modern era of smaller silicon processes (more likely bitflips), DDR5 ECC, and the like.

I knew google went hard on the cheap hardware back in the day, but ECC RDIMMs aren't all that more expensive than consumer-grade, it's only the weird low-volume stuff like unregistered/buffered UDIMMs and SODIMMs that get pricy ime. but those small differences do add up at google scale I suppose