CyberdeceptionAtlas · Question → testES

Library / Paper

Paper

Spoofer or Spoofers? Estimating a Lower Bound on the Number of DRDoS Sources Using Anycast Honeypots

This paper presents a method to estimate a lower bound on the number of networks generating spoofed traffic in DRDoS attacks, using a global deployment of anycast amplification honeypots. The authors develop two estimators based on honeypot reception patterns and TTL variations, analyzing 287 days of amplification attacks. According to the authors, at least 21.0% of attacks originate from multiple network locations.

HoneypotNetwork

What we know

This paper presents a method to estimate a lower bound on the number of networks generating spoofed traffic in DRDoS attacks, using a global deployment of anycast amplification honeypots. The authors develop two estimators based on honeypot reception patterns and TTL variations, analyzing 287 days of amplification attacks. According to the authors, at least 21.0% of attacks originate from multiple network locations.

Evidence limits

This entry is based solely on the publicly available title and abstract; the full text has not been reviewed and the methodology or results have not been independently validated.

Reviewed: author abstract. Full-text results were not analyzed.

Sources and provenance

  1. Spoofer or Spoofers? Estimating a Lower Bound on the Number of DRDoS Sources Using Anycast Honeypots
    abstract · 2026-10-04

Reviewed: 2026-10-04. This record may change when new evidence is found.

RIS · BibTeX