Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Disrupting the largest residential proxy network

cloud.google.com

Post reply on HN
Print view View original

181–190 of 230 posts

Re: Disrupting the largest residential proxy network

#181

Post by toofy »

direwolf20 wrote: post #82
SOTGO wrote: post #24

Earlier quoted context omitted.

I haven't looked at any court documents, but the WSJ article from Wednesday reported that "Last year, Google sued the anonymous operators of a network of more than 10 million internet-connected televisions, tablets and projectors, saying they had secretly pre-installed residential proxy software on them... an Ipidea spokeswoman acknowledged in an email that the company and its partners had engaged in “relatively aggr…

Google does much worse in Google–branded devices and apps, like the wifi location data harvesting.

neat, so let’s stop them too.

the answer is stop all the bad actors, not “well jimmy does it!”

Re: Disrupting the largest residential proxy network

#183

Post by arewethereyeta »

AugustoCAS wrote: post #130

This was easy because it's a Chinese company. The largest companies in this space that do similar this (oxylabs, brighdata,etc) have similar tactics but are based in a different location.

brighdata = Israel i think oxylabs = Lithuanian, child of NordVPN

Re: Disrupting the largest residential proxy network

#185

Post by JasonADrury »

jraph wrote: post #154
JasonADrury wrote: post #152

Earlier quoted context omitted.

Why would the users care either way?

Some people care about ethics, and try to avoid doing bad stuff, or helping the bad stuff.

Sure, but that only answers why some users might care.

Re: Disrupting the largest residential proxy network

#186

Post by TZubiri »

mrweasel wrote: post #166
edg5000 wrote: post #118

Residential proxies are the only way to crawl and scrape. It's ironic for this article to come from the biggest scraping company that ever existed! If you crawl at 1Hz per crawled IP, no reasonable server would suffer from this. It's the few bad apples (impatient people who don't rate limit) who ruin the internet for both users and hosters alike. And then there's Google.

First of: Google has not once crashed one of our sites with GoogleBot. They have never tried to by-pass our caching and they are open and honest about their IP ranges, allowing us to rate-limit if needed. The residential proxies are not needed, if you behave. My take is that you want to scrape stuff that site owners do not want to give you and you don't want to be told no or perhaps pay a license. That is the only ca…

>The residential proxies are not needed, if you behave

I'm starting to think that somee users in hackernews do not 'behave' or at least they think they do not 'behave' and provide an alibi for those that do not 'behave'.

That the hacker in hackernews does not attract just hackers as in 'hacking together features' but also hackers as in 'illegitimately gaining access to servers/data'

As far as I can tell, as a hacker that hacks features together, resi proxies are something the enemy uses. Whenever I boot up a server and get 1000 log in requests per second and requests for commonly exploited files from russian and chinese IPs, those come from resi IPs no doubt. There's 2 sides to this match, no more.

Re: Disrupting the largest residential proxy network

#187

Post by kstrauser »

megous wrote: post #163
edg5000 wrote: post #118

Residential proxies are the only way to crawl and scrape. It's ironic for this article to come from the biggest scraping company that ever existed! If you crawl at 1Hz per crawled IP, no reasonable server would suffer from this. It's the few bad apples (impatient people who don't rate limit) who ruin the internet for both users and hosters alike. And then there's Google.

I'd still like the ability to just block a crawler by its IP range, but these days nope. 1 Hz is 86400 hits per day, or 600k hits per week. That's just one crawler. Just checked my access log... 958k hits in a week from 622k unique addresses. 95% is fetching random links from u-boot repository that I host, which is completely random. I blocked all of the GCP/AWS/Alibaba and of course Azure cloud IP ranges. It's almos…

I’ve been enduring that exact same traffic pattern.

I used Anubis and a cookie redirect to cut the load on my Forgejo server by around 3 orders of magnitude: https://honeypot.net/2025/12/22/i-read-yann-espositos-blog.h...

Re: Disrupting the largest residential proxy network

#188

Post by sitzkrieg »

Spooky23 wrote: post #170
chii wrote: post #131

Earlier quoted context omitted.

But then would you make the same arguments for running a tor node (presumably, you don't know what shady stuff is there, but you know there's shady stuff)?

Running a tor node is pretty stupid from a liability perspective, but at least you have more deniability and you are making an informed choice. These residential proxies are pretty much universally shady. I doubt most of the users understand what they are consenting to.

tor nodes are zero risk as long as they're not an exit

been running nodes since 2017 on two providers and zero issues

Re: Disrupting the largest residential proxy network

#189

Post by sitzkrieg »

ehhthing wrote: post #142
Ronsenshi wrote: post #129

Earlier quoted context omitted.

One thing about Google is that many anti-scraping services explicitly allow access to Google and maybe couple of other search engines. Everybody else gets to enjoy CloudFlare captcha, even when doing crawling at reasonable speeds. Rules For Thee but Not for Me

You say this like robots.txt doesn't exist.

so many things flat out ignore it in 2026 let's be real

Re: Disrupting the largest residential proxy network

#190

Post by kingforaday »

Google shows a samaple of the IOCs but Google Trust Services have issued a number of the SSL certs for those domains that have not been revoked (yet?).

Only looking at the:

- a8d3b9e1f5c7024d6e0b7a2c9f1d83e5.com

- af4760df2c08896a9638e26e7dd20aae.com

- cfe47df26c8eaf0a7c136b50c703e173.com

Looks like a standard MD5 hash domain pattern of which currently there are:

  user@host:/data/domains/2026/01/30$ zgrep -iE '^[a-f0-9]{32}\.com$' com.txt_domains.gz | wc -l
  3005
If you look at some of the others (not listed in Google's IOC), they tend to have a pattern with their SSL certs e.g.:

- 0e6f931862947ad58bf3d1a0c5a6f91f.com

  X509v3 Subject Alternative Name:
    DNS:0e6f931862947ad58bf3d1a0c5a6f91f.com,   DNS:effc538138d9342c547c5df42b03d81e.com, DNS:gulfclouds.site, DNS:xinchaobccgba.net
- 17e4435ad10c15887d1faea64ee7eac4.com

  X509v3 Subject Alternative Name:
    DNS:0dcbdf154c39288c91feb076795715e1.com, DNS:0e8843e8f10f20eeef59f0076e4feb83.shop, DNS:1014a1fb60e1b91404682e572ede6b4f.com, DNS:178281a79266d2faa3e578f23c8a361e.com, DNS:17e4435ad10c15887d1faea64ee7eac4.com, DNS:19f75b2642320e0606f5e38ce9fbcf17.com, DNS:1vxe.com, DNS:292893d0b31941e1c0d8eb01235be4eb.com, DNS:2b1e642f3a60130d1b2cf244891bef0d.info, DNS:354542342b7d2ddb66c97240d0c770dc.com, DNS:37d993ba8c9284bedad2a3177dfc44a6.info, DNS:3857036aaeedf670bbcca926945b50dd.com, DNS:3961f3fa3a6bacc5c4f28e81c60f4169.com, DNS:3eb4b3a3f8722b60d6ba2de7dd5f2523.org, DNS:42a17c71c0d6f2a6d7e135f8e869ab3f.com, DNS:4edd3793da3080640431430a4da57a86.org, DNS:4f5667d51451a2060067a97bcddf077f.info, DNS:5006cc38aff1ebc7d1232037fd592c60.net, DNS:54c35ec930f5b52fd9505778bb9c3f00.com, DNS:60255ec5427c2ba9a80b9c7648dd62e9.com, DNS:638d0e352728a04bb56ca102e54b8c9b.xyz, DNS:69234f9b18c0b4d572dc553dbfdb8f52.com, DNS:6934addf679d79a79f0bfc2ff090b104.com, DNS:694b64c9b41c17a229d92156d14a4ffd4.com, DNS:6eba8c4def89561e1cee02bb3c9b373d.info, DNS:7050f8c6563ff47465932e3838dc06fd.com, DNS:72ad0de0a556f763e0629c64c694df4c.com, DNS:86f7020358afaf71baeee5782b6264e4.xyz, DNS:88f2f20d26dcabeafd2f9d24e7ea4e50.com, DNS:911f4bf053ee3dadae1ca6bfdf40a817.com
would there be any reason any of these would be legitimate?
Post reply on HN