burger retweeted
Bulletproof hosting doesn't run on its own. It depends on facilitators: IP address brokers, carriers, data centers. Remove the facilitators, and the operation stops working.
In this blog, Threat Investigator Jonas Arnold looks at how we hold those facilitators accountable, and why an approach that's slow and methodical still beats one that's fast and shallow.
A few things the data shows:
👉️ IPv4 address brokers are a critical chokepoint for bulletproof hosters
👉️ Carrier and broker responses to SBL listings reveal a lot about their intentions
👉️ Clustering internet badness at specific facilitators makes them attractive to law enforcement
👉️ Evasion tactics from miscreants signal that the pressure is actually working
In case you missed it, read the full post here ⤵️
spamhaus.org/resource-hub/bu…
#BulletproofHosting #ThreatIntel #Cybercrime #HostingProviders
burger retweeted
Something new is coming for abuse.ch contributors...👀
#WatchThisSpace #CommunityHub #SharingIsCaring 😻🥇💛
burger retweeted
Our platforms were recently targeted by a large-scale web scraping operation originating from devices that are apparently participating in residential proxy networks 🏘️ 🖥️ . The vast majority of these requests were successfully blocked by our existing mitigations 🛑 . However, the sheer volume of traffic caused temporary disruptions to both the MalwareBazaar and URLhaus platforms ⚠️
To put the scale into perspective, our web platforms typically handle approximately 1,500 requests per second (excluding traffic to our community API and commercial APIs). During this incident, the scraping operation leveraged more than 135,000 unique IP addresses, most of which could be identified as nodes in residential proxy networks 🔍
The offender attempted to remain undetected by sending very few requests (less than 5) per IP address to the platforms 🕵
Below are the top networks sourcing this traffic (by unique IPs):
2,961 AS25019 SAUDINETSTC 🇸🇦
1,995 AS206206 KNET 🇮🇶
1,984 AS9121 TTNet 🇹🇷
1,954 AS3215 Orange 🇫🇷
1,871 AS12322 PROXAD 🇫🇷
1,550 AS5410 BOUYGTEL-ISP 🇫🇷
1,531 AS37705 TOPNET 🇹🇳
1,413 AS8193 BRM-AS 🇺🇿
We are sharing details of the involved IPs, along with the relevant timestamps, here for your awareness ⤵️
raw.githubusercontent.com/ab…
ALT Top countries sourcing residential proxy IPs targeting abuse.ch platforms
burger retweeted
🎉 We’re proud to sponsor the 38th #FIRSTCon in Denver next month alongside our partner @abuse_ch! Some of the team will be there, joined by colleagues from The @spamhaus Project.
👀 Keep an eye out for a couple of presentations from the team - we’ll share more details closer to the time...
