<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 11 6 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:868681570;
mso-list-type:hybrid;
mso-list-template-ids:-199854936 -1479745450 134807555 134807557 134807553 134807555 134807557 134807553 134807555 134807557;}
@list l0:level1
{mso-level-start-at:0;
mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;
mso-fareast-font-family:Calibri;
mso-bidi-font-family:"Times New Roman \(Body CS\)";}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style>
</head>
<body lang="en-PL" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">IMHO it’s most likely credit farming. I checked other Hostinger probes and they have repeating pattern: deploy 11-15 software probes in the same subnet, behind the same router, in the
same geo location, with incrementing IP and probe ID (mass production of probes). They done it in BR, US, NL, GB, LT, IN, SG and ID (8 countries, 11 cities) with 116 software probes. What they achieved with that? They don’t have to ask for credits because
they have 116 software probes to generate tons of them. Alternatively it’s some kind of internal monitoring but used IPs don’t support this guess. Can RIPE Atlas contact Hostinger to explain what are they doing with all these probes?<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-fareast-language:EN-US">Emile Aben, I would be happy to see code for detecting overly similar probes. It would save a lot of time spend on data filtering.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">Regards,<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US">Grzegorz</span><span style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">Gert Doering <gert@space.net><br>
<b>Date: </b>Monday 2022-04-04 at 15:51<br>
<b>To: </b>Andreas Härpfer <ah@v6x.org><br>
<b>Cc: </b>RIPE Atlas <ripe-atlas@ripe.net><br>
<b>Subject: </b>Re: [atlas] Overuse of software probes<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Hi,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">On Mon, Apr 04, 2022 at 02:30:19PM +0200, Andreas Härpfer wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #B5C4DF 4.5pt;padding:0cm 0cm 0cm 4.0pt;margin-left:3.75pt;margin-right:0cm" id="MAC_OUTLOOK_ATTRIBUTION_BLOCKQUOTE">
<div>
<p class="MsoNormal">I totally agree. As I said, I was only guessing, but I<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">couldn't come up with a better explanation why someone<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">would want to have 15 probes within the same /24. If<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I am missing out on other cool things that can only be<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">done with this kind of setup, I'd be happy to learn :-)<o:p></o:p></p>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">They might use the probes to do in-AS measurements... <o:p>
</o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Historic anecdote: at some time, DECIX had multiple TTM boxes ("back
<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">then") to monitor their fabric across different locations in Frankfurt.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">So this might be something similar.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Or not, maybe just a student competition "who can get more probes<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">into Atlas" :-)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Gert Doering<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> -- NetMaster<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">-- <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">have you enabled IPv6 on something today...?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">SpaceNet AG Vorstand: Sebastian v. Bomhard, Michael Emmer<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Joseph-Dollinger-Bogen 14 Aufsichtsratsvors.: A. Grundner-Culemann<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">D-80807 Muenchen HRB: 136055 (AG Muenchen)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Tel: +49 (0)89/32356-444 USt-IdNr.: DE813185279<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>