





Yeh, exactly. “You have the ip to work with”
one.one.one.one isnt an http/ request, its a dns lookup.
If it was an http/s request to 1.1.1.1 then it could be blocked. Also, super cheap/easy to proxy


You have the destination IP to work with, thats it. Otherwise it just looks like any other HTTPS traffic.
I guess if you uplpaded your own root CA cert tgen you could man-in-the-middle for deeper packet inspection.
Or, i guess, try using eMudhra’s compromised private keys and hope the clients havent been updated yet


They will be using data center compute to generate the traffic, but proxy it through residential proxies and other compromised devices that form a botnet.
Central generation with remote access for the trolls, and distributed outbound traffic.