Tailscale mass node enrollment via tailscale up with auth key

Suraj A@cytech

•updated yesterday•6•0•9

Detects repeated execution of the Tailscale VPN client using an authentication key (tskey-auth-) 5 or more times within a 1-hour window on the same device or account, which may indicate mass or rogue node enrollment.