Toicon.com embeds your IP-address in the SVG icon file you've downloaded
files.mastodon.social
Related, SVGO (or my preferred in-browser frontend, SVGOMG[0]) does a wonderful job of cleaning up SVGs and removing unnecessary metadata/comments. I throw every SVG into it before it enters my codebase.
Doesn't prevent someone from encoding the IP address in colors or something though.
Should we know what toicon.com is?
What does the TLA for IP address exposure look like these days?
The screenshot (which is the format we naturally expect all security alerts to be released in) shows an IPv4 address. Does it support v6? I quake at the thought of my personal ~32-bit number being known to anyone else[0].
[0] https://zmap.io/ “With a 10gigE connection and PF_RING, ZMap can scan the IPv4 address space in 5 minutes.”
I think the TLA you were looking for is TRA?
You know what, at first glance this looks like some sort of insane workaround for another issue somewhere else. There’s no possible rational explanation I can come up with to be doing this, but what do I know.
Ironic the website author says it’s taken the site down because it could host malware.
Found some Toicon.com icons on Wikipedia, but they all have 127.0.0.1 as IP address