Collateral damage [LWN.net]

Collateral damage

Posted Aug 29, 2026 19:20 UTC (Sat) by pizza (subscriber, #46)
In reply to: Collateral damage by willy
Parent article: Ryabitsev: Creepy crawlies

> And this is exactly the behaviour of a botnet. Each node gets handed a list of a few hundred URLs to go off and fetch. None of them have anything to do with each other.

This would be a huge improvement from what I typically see, where there there are at least hundreds of thousands [1] of nodes that each only ask for a single URL

[1] The single largest round I saw exceeded 1.5 million unique IPs over the course of about 24 hours, requesting (on average) about 1.1 URLs.

to post comments

Collateral damage

Posted Aug 31, 2026 10:25 UTC (Mon) by paulj (subscriber, #341) [Link] (2 responses)

Out of curiosity, how are you able to assign millions of singleton requests from IPs to one entity? How would you distinguish between N and M (N > M > epsilon) entities operating such botnets? I guess you're just clumping by seeing some level of load (± whatever) continue over some time frame?

Collateral damage

Posted Sep 1, 2026 16:54 UTC (Tue) by NYKevin (subscriber, #129325) [Link]

There are other ways of correlating bot traffic, but the folks who do this sort of thing do not want to publicly disclose those ways for fear that the botnets will adapt.

Collateral damage

Posted Sep 1, 2026 20:26 UTC (Tue) by Cyberax (✭ supporter ✭, #52523) [Link]

There are several obvious ways to do it, like tripwire links: add a random element to some links that is IP-specific. Then check if this element appears in requests from multiple IPs. You can also add hidden links that can't be followed by normal users, and so on.

The problem is that it costs a lot to run these mitigations, both in complexity and runtime cost.