News for hackers. Stuff that matters.

A comment on The Web Is Broken – Botnet Part 2. Parent comment

Re:The Web Is Broken – Botnet Part 2 by andelink on Saturday April 19, 2025 @08:42PM (#43740651)
The first blog post in this series[1], linked to at the top of TFA, offers an analysis on the potential of using ASNs to detect such traffic. Their conclusion was that ASNs are not helpful for this use-case, showing that across the 50k IPs they've blocked, there is less than 4 IP addresses per ASN, on average.

[1] https://jan.wildeboer.net/2025/02/Blocking-Stealthy-Botnets/

[ Parent | on HN ]
Re:The Web Is Broken – Botnet Part 2 by reconnecting on Sunday April 20, 2025 @12:40AM (#43741566)
What was done manually in the first blog is exactly what tirreno helps to achieve by analyzing traffic, here is live example [1]. Blocking an entire ASN should not be considered a strategy when real users are involved.

Regarding the first post, it's rare to see both datacenter network IPs and mobile proxy IP addresses used simultaneously. This suggests the involvement of more than one botnet. The main idea is to avoid using IP addresses as the sole risk factor. Instead, they should be considered as just one part of the broader picture of user behavior.

[1] https://play.tirreno.com

[ Parent | on HN ]