[cuu508]

1.1.1.2 blocks malware, and archive.today performs DDOS. Where's the false reasoning?

[croes]

It‘s not a C&C/Botnet

[cuu508]

It is C&C -- it instructs their site visitors to DOS a specific site.

[zahlman]

By this logic, all malicious JavaScript (obvious example is cryptominers I guess, assuming no JS sandbox escape) is C&C, yeah? As it "instructs site visitors" to do something harmful locally?

[croes]

A C&C controls a botnet, where is the botnet?

[cuu508]

The browsers of their site visitors.

[croes]

If you need to be on the site it’s not a botnet and there is no C&C server coordinating the attack. It‘s just the JS on the site that makes the attack.

[jojomodding]

> If you need to be on the site it’s not a botnet

Why? I did not visit the site to participate in a DoS attack; yet my machine was coaxed into participating against my will. Whether this is happening in JS or a drive-by download or a browser 0-day is irrelevant.

[Hamuko]

Does this mean that the Great Cannon of China is not a botnet because it stops working when you close your browser?