IMHO it’s most likely credit farming. I checked other Hostinger probes and they have repeating pattern: deploy 11-15 software probes in the same subnet, behind the same router, in the same geo location, with incrementing IP and probe ID (mass production of probes). They done it in BR, US, NL, GB, LT, IN, SG and ID (8 countries, 11 cities) with 116 software probes. What they achieved with that? They don’t have to ask for credits because they have 116 software probes to generate tons of them. Alternatively it’s some kind of internal monitoring but used IPs don’t support this guess. Can RIPE Atlas contact Hostinger to explain what are they doing with all these probes?

Emile Aben, I would be happy to see code for detecting overly similar probes. It would save a lot of time spend on data filtering.

Regards,

Grzegorz

From: Gert Doering <gert@space.net>
Date: Monday 2022-04-04 at 15:51
To: Andreas Härpfer <ah@v6x.org>
Cc: RIPE Atlas <ripe-atlas@ripe.net>
Subject: Re: [atlas] Overuse of software probes

Hi,

On Mon, Apr 04, 2022 at 02:30:19PM +0200, Andreas Härpfer wrote:

I totally agree.  As I said, I was only guessing, but I

couldn't come up with a better explanation why someone

would want to have 15 probes within the same /24.  If

I am missing out on other cool things that can only be

done with this kind of setup, I'd be happy to learn :-)

They might use the probes to do in-AS measurements...  

Historic anecdote: at some time, DECIX had multiple TTM boxes ("back

then") to monitor their fabric across different locations in Frankfurt.

So this might be something similar.

Or not, maybe just a student competition "who can get more probes

into Atlas" :-)

Gert Doering

        -- NetMaster

--

have you enabled IPv6 on something today...?

SpaceNet AG                      Vorstand: Sebastian v. Bomhard, Michael Emmer

Joseph-Dollinger-Bogen 14        Aufsichtsratsvors.: A. Grundner-Culemann

D-80807 Muenchen                 HRB: 136055 (AG Muenchen)

Tel: +49 (0)89/32356-444         USt-IdNr.: DE813185279