Public APIs often have max-per-page forced pagination to reduce load on their infra, whereas private infra like the bitcoind RPC often don't implement a hard max and even do not set an initial default.
Thus, when you see a low artificial limit in an attack, like 200 utxo max which is significantly under the max tx size, especially for p2wpkh, but also for old school p2pkh, it is extremely likely that a service was used and not sovereign infra. And that is the kind of lead that can break an investigation from hopeless into catching a lazy attacker if you'd be, say, representing a victim.
I'm glad that Block found the same and chased it down.
Missed this, apologies!
Public APIs often have max-per-page forced pagination to reduce load on their infra, whereas private infra like the bitcoind RPC often don't implement a hard max and even do not set an initial default.
Thus, when you see a low artificial limit in an attack, like
200utxo max which is significantly under the max tx size, especially for p2wpkh, but also for old school p2pkh, it is extremely likely that a service was used and not sovereign infra. And that is the kind of lead that can break an investigation from hopeless into catching a lazy attacker if you'd be, say, representing a victim.I'm glad that Block found the same and chased it down.