I haven't talked with the user involved besides trying to stop the bleeding, but it seems it was around the OSX java exploit on a BYOD mac laptop. You are total

I haven't talked with the user involved besides trying to stop the bleeding, but it seems it was around the OSX java exploit on a BYOD mac laptop. You are totally correct though, I could do more to restrict this. But, if I can nuke the ip block because I will never get legit traffic from it anyway why not?