Hacker News new | ask | show | jobs
by stephengillie 4072 days ago
Botnets must leverage their infected host's internet connection. Almost all anti-bot tools use IP/rate metrics to identify the classic DOS: a large number of connections from a few IPs.

To get around Threatstop, Distil, and other solutions, we see attackers having to use 100+ different source IPs during their coordinated attacks.

1 comments

Low-traffic botnets could be clicking on ads, simulating normal usage patterns.