Dslroot, Proxies, and the Threat of 'legal Botnets'

It is so easy to pay a college student to get them to whitelist a MAC address for a GLiNet router you install somewhere in a university.

Interesting article. I’ve been curious for a while about how residential proxy IPs are collected too. Many come from shady browser extensions or mobile apps, especially free VPNs (wink wink Hola VPN). People often don’t realize they are turning their device into an exit node.

Some time ago I started to track this as a side project (I work in bot detection and was always surprised by how many residential proxies show up in attacks). It started just out of curiosity. Now I collect proxy IPs, which provider they belong to, and how often they are seen. I also publish stats here: https://deviceandbrowserinfo.com/proxy-api/stats/proxy-db-30...

For example, in the last 30 days I saw more than 120K IPs from Comcast and nearly 100K from AT&T.

I also maintain an open IP (ranges) blocklist, mostly effective against data center and ISP proxies. Residential IPs are harder since they are often shared with legit users: https://github.com/antoinevastel/avastel-bot-ips-lists

Even if you can’t block all of them, tracking volume and reuse gives useful signal.

If you have a product worth buying, it's also worth stealing.

The existence of residential proxies like these is a massive pain if you run free trials or giveaways or host user-generated content (aka a spam/scam opportunity). DSLRoot is only one service of many (see last year's takedown of 911 S5 https://www.scworld.com/news/fbi-takes-down-911-s5-botnet-li... ) and there's plenty of demand for it.

Imagine getting hit by thousands+ of different IP addresses with different user agents, etc. Banning these IPs is not a great option - lots of collateral damage because many real people share IPs, depending on ISP setup.

I work on bot detection involving device fingerprinting - imo this is one of the only ways to defend against residential proxy activity, since you can sniff out the warning flags of automation software and other shared indicators regardless of IP.

Residential proxy botnets have exploded since LLMs became a thing. The amount of DDoS-level scraping we receive from residential IPs has exploded over the last year, one of our sites that typically sees around 10k unique IPs per day jumped to over 2M before we were able to deploy appropriate mitigations. We originally started blocking the IPs, but then we ended up blocking legitimate users as they seem to specifically use ISPs that have very dynamic IPs (i.e. the customer's IP will change even if their router stays on 24/7).

> “When I open the computer, it looks like [they] have some sort of custom application that runs and spawns several cmd prompts,” the Redditor explained. “All I can infer from what I see in them is they are making connections.”

Surprised me that the laptop seemingly wasn't even password protected.

What happens once these residential IPs end up on CSAM or terrorism or IP infringement lists?

I ran a proxy in ~1996 so students could MUD from restricted uni shells, but one weekend I went to visit my parents and there was a knock on the door and a smartly dressed man interrogated me about a plot to assassinate Clinton. (he was Special Branch sent on behalf of the Secret Service and FBI)

I've seen way too many crypto adjacent "legal botnets" too and I dont think you could pay me enough to run some sketchy app like that, even if open source, even if fully vlan'd and isolated.

Unfortunately theres a lot of desperate people who will run random apps thinking it'll make them a quick buck.

On the one hand, the guy makes it sound like it 'spawns cmd prompts' which suggests a Windows machine and a bunch of amateurs selling crap to third parties (and to the state), instead of being a state level actor. (which shouldn't be able to gather that much valuable metadata by spying on the network anyways)

On the other hand, 250$ is a suspiciously high number when you can get a dozen people to do it for 50$ in an afternoon.

ps. "top secret" clearing is a not secret club - it's a very big club and its practical purpose is you agreeing to increase legal liability by getting thrown into a different judicial tract if you screw up - eg by installing Russian hardware on your home.

Seems like easy money for slumlords that don't live on site or young people who have roomates the internet is under. Throw a laptop in the attic/basement. Buy it it's own dedicated line from Comcast or whatever. From there you're basically being paid $250/mo to be willing to say "I have no idea, I set it up and forgot about it, I assume it's so Europoors can watch the NFL without paying out the nose" to the cops at some undetermined point in the future.