Ask HN: Is there a market for selling IPs identified as bot traffic? I've been experiencing a lot of bot traffic that needs to be blacklisted. I am able to capture the IPs. I am just curious if there are there companies interested in purchasing such IP information? I am certain these are bots and they also target specific vulnerability. If not to sell, I would like to atleast share with companies who are in this space. |
Under address rental models in cloud/service providers an address can be ephemeral to a bad actor for minutes, and then back in the pool. If you apply this kind of filter, somebody else taking service from AWS or a sub-tenancy can find themselves in the bad place.
Third party damage risks basically.
You could potentially otherwise check https://www.projecthoneypot.org/
This is the ancestor of Cloudflare and still actively flagging IPs for bad bots, which is probably a source in Cloudflare itself.
I suppose that is a long winded way of saying I doubt there would be much interest in paying for IP lists as the greater value lies in understanding traffic behavior and packet characteristics. Perhaps if you started writing advanced eBPF code that could mostly-accurately separate traffic into bot vs non-bot then you would have created a piece of Cloudflare and people might pay to self host that. If going this route one should create public challenges to validate the accuracy and ability to "spot the bots". Independent third parties must participate in the challenge to validate both the ability to "spot the bots" and also not block legitimate people. That would be valuable. To garner interest there should be a free version.
I can speak from experience that some companies are not permitted to send specific types of traffic over a third party such as a CDN and that would be the use case for self hosted bot mitigation. Some companies try to accomplish this using bot mitigation in hardware load balancers, multi-million dollar firewalls and DDoS appliances. These devices are expensive and do not scale well not to mention they only stop very specific types of bots and attacks. These devices are also sometimes the causes of outages. In my experience, the more expensive a device is and the more promises around said device, the more glorious of an outage it will cause.