Detecting VPNs/proxies by analyzing their attack patterns over time

No ratings

Presented at hack.lu 2023 by

Emanuel Seemann

At Crowdsec we receive a lot of signals of users detecting attacks using our open source intrusion prevention system. We used these signals to detect whether attackers are behind anonymization services such as proxies or VPNs. We show that by monitoring changes in attack behavior over time we can reliably detect proxies and VPNs and use this data to improve our threat intelligence.