Earlier quoted context omitted.
How does fingerprinting them help? You can fingerprint them but they are just desktops/mobile phones/laptops that have been compromised to be part of the botnet. The compromised hosts that are part of the botnet look exactly like normal traffic.
That's not what the article said though. They say that the compromised devices had these characteristics among others: * Port 2000 open * Port 5678 open * SOCKS proxy on port 80 (maybe) Most likely most of the visitors to your website won't have those ports open and exposed to the Internet. That is a really easy way to filter traffic based on the network fingerprint. Especially when you're under attack it's a great w…
Implemented here: https://github.com/craig/merisbot-detect
Do you have more info on port 80/socks?