Hacker News Reader

It isn't just random residential IPs, but what appears to be BGP hijacking of/onto residential networks on top of that.

Can you elaborate?

If the troll is using residential proxies, you might try abuse@ the handful of services that offer such things. There aren't that many. I don't know if they actually take abuse seriously, but it can't hurt.

Luminati has an abuse form: https://luminati.io/report-abuse

What's the basis for assuming BGP hijacking? That would be very sophisticated attack to just troll some random website.

The skid is not the one doing it. They are buying from semi-professional "proxy sellers" that do it and then sell you some form of authenticated squid proxy that further makes the request.

Can't he fake the source IP address by sending raw packets? Are they sanitized in any way?

That wouldn't work for HTTP(S) or anything else that works over TCP since the reply would go towards the fake source IP address, thus the attacker couldn't even get past the 3-way TCP handshake.

Reply on news.ycombinator.com