|
|
Log in / Subscribe / Register

Collateral damage

Collateral damage

Posted Aug 31, 2026 10:25 UTC (Mon) by paulj (subscriber, #341)
In reply to: Collateral damage by pizza
Parent article: Ryabitsev: Creepy crawlies

Out of curiosity, how are you able to assign millions of singleton requests from IPs to one entity? How would you distinguish between N and M (N > M > epsilon) entities operating such botnets? I guess you're just clumping by seeing some level of load (± whatever) continue over some time frame?

to post comments

Collateral damage

Posted Sep 1, 2026 16:54 UTC (Tue) by NYKevin (subscriber, #129325) [Link]

There are other ways of correlating bot traffic, but the folks who do this sort of thing do not want to publicly disclose those ways for fear that the botnets will adapt.

Collateral damage

Posted Sep 1, 2026 20:26 UTC (Tue) by Cyberax (✭ supporter ✭, #52523) [Link]

There are several obvious ways to do it, like tripwire links: add a random element to some links that is IP-specific. Then check if this element appears in requests from multiple IPs. You can also add hidden links that can't be followed by normal users, and so on.

The problem is that it costs a lot to run these mitigations, both in complexity and runtime cost.


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds