This might be non trivial to figure out. You’d need to compile a list of VPN IP ranges or ASNs and then look at average traffic rates for those locations to then account for the baseline.
This is gonna get hairy pretty quickly jsyk - even whois records are questionable in validity sometimes so you might be poisoning your own data
Last I knew monero and other ecurrencies are used heavily by cyber threat groups (APTs). Sometimes you can trace out their whole operations network from the data.
Look around for more info - I’d recommend looking up info on crypto osint
Most of APTs are not really skilled about opsec usage. Last biggest actor were Lazarus and they did the mistake to not use bisq. LockBit for example is still using Bitcoin
Idk anything about their specific infra or procedures/practices tbh. I just know that threat researchers love lookin through crypto public record/graphs and correlating them fuckers
Add comment