It's quite well known that if an attacker wanted to, they could spoof their IP address by using a proxy server or some other means.

Whilst that's possible, whenever I perform a geo-location lookup on the IP addresses that conduct automated brute force attacks, probing, port scanning etc. against my servers, almost always the IP addresses do resolve to countries associated with cyber crime, like:

  • China
  • USA
  • Russia
  • Turkey
  • Italy
  • etc.

Knowing that the Internet is very independent of geography, for example it's possible to sign up with server hosts anywhere in the world and in fact it would be desirable - from an attackers point of view - that their IP was not associated with a country with a bad reputation.

Also, because servers are sometimes added to a botnet when compromised, I always assumed remote servers were the preferred "weapon of choice" for attackers.
However, I'm now wondering - are the people conducting this activity forced to use local ISP's in countries with more lax laws and that don't crack down on malicious activity (I'm assuming they can't get access to all the big name reputable providers - because their accounts would be shut down quite quicky)?

And does this also then mean that they generally have to supply their own machines? I know there are lots of ways to setup a computer and connect to the Internet - but what is the typical setup for these automated bots regarding whether they are remote rented servers or local physical machines and how do they get Internet access?


There are some academic papers that describe Windows botnets from an architectural viewpoint:

It appears that most botnets have at least 3 layers:

  1. The computers running the working code. Looks like these are almost always compromised computers.

  2. An intermediate layer, sometimes compromised, sometimes actually paid for.

  3. The actual command and control machine. Almost always bought and paid for, not someone else's servers they've hacked.

The un-hacked, bought-and-paid for servers appear to either be in places like Kazakstan, or hosted on "bulletproof" ISPs. Some of those bulletproof ISPs have gone out of business or been taken down legally. Google for "McColo" for details of one of these.

  • thanks, that's provided some very insightful reading into spam botnets and seem to confirm my suspicions that these "bulletproof ISP's" play a big role in supporting cyber crime activities. However in the context of the constant malicious activity targeted to servers (brute force attacks, port scans etc) It seems to me if the machines responsible were compromised hosts - recruited on an adhoc basis - then wouldn't the attacks appear to be come from otherwise nondescript machines whose geography was randomly distributed and the only common characteristic between them was lax-security. – the_velour_fog Nov 19 '15 at 1:06
  • wouldn't you then see many IP addresses from "regular" countries - owned by innocent users. I agree that from a hackers point of view it would be ideal to have an elaborate botnet of compromised machines with some - hard to identify - remote command and control center and encrypted communication withthe botmaster etc. Im sure a significant amount comes from such machines. But what I see on my web servers is that maybe 80% of the malicious activity comes from machines hosted on these bulletproof ISP's. It seems the majority simply get an account on a bullet proof ISP and just start hacking – the_velour_fog Nov 19 '15 at 1:22

The ideal automated bot is somebody else's machine that you have compromised because their security wasn't good enough. You can then control that machine remotely, preferably via some channel that doesn't trace easily back to you (IRC used to be popular).

  • Thanks, Im more trying to find out what the "typical" bot setup is and how they get access to the internet - I'm guessing that they need to use ISP's that are permissive of their activity - for whatever reason. – the_velour_fog Nov 18 '15 at 12:03
  • 2
    @user4668401 What is a "typical machine of someone else"? RIght, there is no typical [bot] computer. And you're overestimating what an ISP can do, big times. – deviantfan Nov 18 '15 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.