I've tried googling but can't find a satisfactory answer. Probably looking up the wrong search terms...

I see questions on here and other forums that state they have a sophisticated attacker utilizing 50k, even 100k+ IP addresses to brute force logins, look for email matches, even DDOS.

I'm familiar with botnets, and I assume that's a part of the answer, but is there more? I've seen places you can purchase static IP's as a proxy for ~$1 a pop, seems impractical for black hat work though, and those proxy sites would have incentive to keep their IPs not-blacklisted as widely as possible. There's also articles like this and this - again it seems far too costly for black hat work, but maybe?

To use AWS as example, is this something that can be accomplished by setting a static/elastic IP to an instance, using til ban, then dropping and attaching a new IP? I know there are CL automations for such actions in both ec2 and lightsail - I assume this also works in Google Cloud or Azure -- but I doubt the big players let this slide/don't catch on right away.

So is it really all botnets? Are there other methods? Can a nefarious actor (somehow)reserve large swaths of IP addresses through the American Registry for Internet Numbers or through another entity?

  • 1
    There are a million possible ways and it varies wildly, so if you are looking for a definitive answer, you aren't going to get it Commented Aug 28, 2020 at 2:07
  • You looked up the cost for a single IP proxy. Did you look up the costs for a 100,000 node botnet? google.com/search?q=rent+botnet+price Isn't that the more relevant question to ask?
    – schroeder
    Commented Aug 28, 2020 at 7:47
  • @ConorMancone More so looking for some ways it's accomplished, for large swaths like this I'd guess there has to be some pattern or commonality, which could(?) lead to ways to prevent bad actors from obtaining IP addresses in the first place. Appreciate the insight regardless
    – TCooper
    Commented Aug 28, 2020 at 22:14
  • @schroeder Would you say that more or less answers the question then? They simply use botnet's because even those who couldn't manage to scrape together that many vulnerable PCs to control can rent them cheaply from others who have already perfected it? Or are there other methods?
    – TCooper
    Commented Aug 28, 2020 at 22:22
  • Rent a botnet or create your own. That's how you get a large pool.
    – schroeder
    Commented Aug 28, 2020 at 23:28

1 Answer 1


Some attacks like DDOS could be achieved by IP spoofing which causes other DNS server to respond to target spoofed IP causing packet flood. In this case, a handful source IP could be enough.

Although assigned by ARIN, IP addresses are routed at local level and the ownership is advertised by the owning entity. If no one objects, you could claim someone else's IP addresses and use them. This is possible because of dormant or unannounced IP ranges (think of a bankrupt company who owned a range of IPs from early 2000s). You can see the recent Bitcanal case here: https://krebsonsecurity.com/tag/ip4transfer-net/

Not the answer you're looking for? Browse other questions tagged .