Questions tagged [botnet]

A botnet is a collection of computers that are under the control of a person or group, usually facilitated by malware. These computers are often used to take part in DDoS attacks and spamming.

Filter by
Sorted by
Tagged with
1 vote
1 answer
144 views

ThreatFox alert on Cloudflare IP

On our company network, suricata just raised the following (single) alert: { "timestamp": "2024-01-05T12:42:28.511703+0100", "flow_id": 1276412390854359, &...
Heinzi's user avatar
  • 3,088
1 vote
0 answers
95 views

Newsletter Spam Attack - Somehow by not directly attacking?

Our website(shopify website) has been getting a bot attack on our newsletter subscription form. Not sure if emails are real or not but there is some from gmail and hotmail etc or some from weird ...
tarik's user avatar
  • 11
0 votes
2 answers
162 views

Hosting a Honeypot to collect data [closed]

I want to collect IoT botnets in order to analyze them. Are there any good VPS providers who allow to do that? - I'm a little cautious about this because of possible misconfigurations that could ...
Jan's user avatar
  • 3
3 votes
0 answers
115 views

Can botnets/malicious traffic be effectively reduced on my exit nodes?

I host a small collection of TOR exit nodes to the clear net. Believe it or not, the number one complaint I get in my inbox is not due to illegal materials coming through the nodes (of which I have ...
tuskiomi's user avatar
  • 192
5 votes
1 answer
207 views

Protection of API from abuse (signup and carding attacks)

I have a backend (API) and mobile apps. Mobile apps user use same client_id (Oauth2). Now I see many Bots signing up, adding credit card for checking them (carding) I cannot throttle, limit them since ...
dev's user avatar
  • 997
2 votes
0 answers
1k views

Checking IP's reputation on CloudFlare and Google [closed]

Google and CloudFlare have recently indicated that my home IP address is contributing to a DDoS or spam network. I am frequently being checked (What is the website checking about my browser to protect ...
Peter Becich's user avatar
0 votes
0 answers
86 views

Web browser Service Worker contributing to DDoS attacks and spam?

Google and CloudFlare have recently indicated that my home IP address is contributing to a DDoS or spam network. In addition to all the other usual vectors, are web browser Service Workers a potential ...
Peter Becich's user avatar
1 vote
1 answer
307 views

Preventing Signup API abuse from botnet

I am working on an e-commerce website, wherein make use of mobile OTP authentication for new signups. We have a fair bit of protection against bots and malicious actors by using aggressive rate ...
Abhinav's user avatar
  • 159
0 votes
2 answers
202 views

How are IoT botnets even a thing when the only write-able folder is /var or /tmp and both gets reset every restart?

This "No Persistence" and having to re-infect again after every reboot seems so inefficient for IoT to be such pursued targets. Also, most of the persistence methods I have seen tend to be ...
MoooonX's user avatar
  • 15
0 votes
0 answers
100 views

Malware sinkhole evasion techniques

I have read into malware sink holing, as a way to disrupt botnets. There are also approaches to make this more difficult, for example using a Domain Name Generator algorithm which is what the ...
questioner's user avatar
5 votes
0 answers
308 views

Why am seeing all these Chinese proxy domains? [closed]

Through a casual Google search I came to this Stack Overflow result. I clicked it absent-mindedly, could not connect through the server and saw that he domain was some Chinese government proxy server. ...
Maarten's user avatar
  • 151
0 votes
1 answer
178 views

Why do DDoS attacks spoof DNS source IPs?

Recently, a lot of my friends have been talking about botnets. They said they've created their own.‌‌ Obviously, I ​​know this is all illegal so I try not to take part in any of it. But I've been ...
Hackermon's user avatar
27 votes
2 answers
9k views

How is Google abused for DDoS attacks?

While analysing a DDoS attack on my site using CloudFlare console, I've noticed that many attack requests come from AS139190 GOOGLE-AS-AP Google Asia Pacific Pte. Ltd. with Empty user agent. I'm ...
blnks's user avatar
  • 383
0 votes
1 answer
184 views

Can Mirai scan reach devices behind routers?

I recently saw this article of a version of Mirai being spread to Android based devices via ADB enabled. My question relates to how Mirai does scanning. Lets assume I have a Android based device (like ...
Jake's user avatar
  • 1,095
0 votes
1 answer
706 views

Can't free proxies be used to create a botnet?

I recently learned that there are plenty of services on the internet that offer/list free public proxies (freeproxylists.net, hidemyass.com, proxyscrape.com to name a few). Is this safe? Can't an ...
Guy4444's user avatar
  • 47
-1 votes
1 answer
228 views

How was the router compromised? [closed]

ISP sent a message telling that they've detected some bot network characteristic traffic from a router's IP address. Recommended countermeasures have already been taken, i. e. connected laptop's ...
jka's user avatar
  • 113
2 votes
1 answer
351 views

Why do infected hosts scan port 80?

I have my serve set up with AbuseIPDB so I can keep a log of all suspicious request and hacking attempts for my honeypot machine. I noticed an IP that sent a GET request to port 80. 177.154.28.130 - - ...
x43's user avatar
  • 203
1 vote
2 answers
340 views

Do some IoT devices connect to your wifi without you knowing it?

I keep hearing about refrigerators and automated vacuum cleaners being targeted, but do the owners manually configure these devices to connect to their wifi network or do the devices have a work ...
Lucas Shuck's user avatar
1 vote
1 answer
210 views

Why do bots visit my website even though it hasn't been shared with anyone yet?

Is this usual? These bots hit my website every 15 minutes and they're the only visitors I get since I haven't shared the website with anyone yet... How do they even know about my website? What is the ...
Paul Richard's user avatar
0 votes
0 answers
142 views

DDoS in form of bad bots?

Recently, one of my servers came under attack by DDoSing it. After inspection of access logs, I can only find one common denominator: Referrer. All of request come with (I assume) fake referrer: ...
Jovan Perovic's user avatar
1 vote
0 answers
145 views

How are accountgenerators with captchas still possible?

I was asking myself, how there are still account generators (e.g. for Steam) wide available for everyone. With account generators I mean programs, that are automatically creating a huge amount of ...
Rechtsgewinde's user avatar
0 votes
1 answer
160 views

Using opensource C2 dangers

I've been playing around with some of the C2's available at GitHub that I've found at https://www.thec2matrix.com/matrix It's cool to play around with tons of Linux machines I own and send them ...
Napal's user avatar
  • 155
1 vote
1 answer
178 views

Why attacker do not care about masking the IP of the infected device of botnet?

I get a sentence: If an attack is created using a botnet the likelihood of tracking the attack back to its source is low. For an added level of obfuscation, an attacker may have each distributed ...
244boy's user avatar
  • 925
1 vote
1 answer
148 views

What does "hijack" mean in networking security?

How should I understand the word "hijack" in network security? In Cloudflare's page about the Mirai botnet, there is a sentence: The Mirai botnet employed a hundred thousand hijacked IoT devices ...
244boy's user avatar
  • 925
1 vote
1 answer
303 views

How do botnets self-propogate exactly?

I am learning about malware and botnets and came across that botnets can "self-propogate" and I am confused as to how they can do this. I know that a botnet can be created through multiple people ...
HotWheels's user avatar
  • 113
1 vote
1 answer
203 views

Why fingerprint a browser if a fingerprint can be replayed?

I'm facing an issue with rampant scraping and abuse on a website that costs me a good chunk of money to maintain. So, I have been looking to implement a few solutions, and apparently these solutions ...
user avatar
85 votes
10 answers
17k views

How and why is my site being abused?

I own a popular website that allows people to enter a phone number and get information back about that phone number, such as the name of the phone carrier. It's a free service, but it costs us money ...
Marc's user avatar
  • 699
31 votes
10 answers
10k views

Received email from ISP saying one of my devices has malware

My dad received a suspicious email from our ISP (mtnl.net.in). The email was from [email protected] and it had our user ID (I masked it as xxxxxxxx@a) in the email so it must have come from the ISP ...
Nigel Fds's user avatar
  • 463
0 votes
1 answer
471 views

Malicious IP addresses [closed]

I am looking for updated lists of IP addresses that belong to malware's C&C, botnets, malicious scanners, or other sort of malicious activities. Is there any public database of malicious IP ...
MOH's user avatar
  • 31
-3 votes
2 answers
189 views

What's the main constituent part of botnet?

Is the botnet controlled broiler of servers or personal PCs? We know the botnet can be controlled to DDoS attack, but what's the main constituent part of botnet? I know the botnet's element maybe PC,...
244boy's user avatar
  • 925
82 votes
5 answers
15k views

Email Account under attack (really) - anything I can do?

Over the last week, there is a constant barrage of authentication failures to my email account from a variety of ip addresses - usually in blocks of exactly 575 attempts. My password is as strong as ...
clemdia's user avatar
  • 831
2 votes
2 answers
734 views

Zeus v3 - can I detect its existence "manually"?

A firewall in my company was triggered by a DNS query from one of our laptops. Specifically, the exact reason was MALWARE-CNC Win.Trojan.Zeus v3 DGA DNS query detected. Now, I could just follow this ...
MBender's user avatar
  • 380
1 vote
0 answers
128 views

Question on a decentralized botnet, is this technically how communications would flow? (Flowchart)

I am trying to get into and researching botnets, to help myself learn and others prevent attacks. First thing is understanding how decentralized botnet's work. I asked a question yesterday explaining ...
ABC's user avatar
  • 115
0 votes
1 answer
300 views

How does the server-client scheme work in a botnet?

I am having trouble wrapping my head around the idea on how a server-client botnet structure actually works. Let's say that the server is A, and the client is B. We know A is listening always on ...
ABC's user avatar
  • 115
3 votes
2 answers
1k views

Server getting probed: why can I see successful GET requests to other sites?

I put up my site yesterday and this morning I saw a lot of requests in the logs. I have seen this before, and immediately could tell it was someone/something probing the server. Most of the requests ...
turnip's user avatar
  • 795
1 vote
2 answers
230 views

Are botnet nodes made to stop working during office hours?

Some network guys at my work seem to think that a client that we monitor may be part of a botnet, but the spike in traffic that we see at night always stops at the latest around 8am in time for office ...
LBC's user avatar
  • 13
2 votes
1 answer
287 views

Honeypot SSH connection attempts with no interaction

I am seeing a lot (>50% of total events) of connection events on a honeypot I have set up but there is no further interaction, no brute force, just a connect then disconnect. I'm thinking this is ...
Derezzed's user avatar
-1 votes
2 answers
462 views

Which are the most dangerous and popular botnets that came from IoT devices?

The ease of taking control of a cheap IoT device makes them the perfect target to craft a botnet to perform DDoS attacks. I heard about botnets created from a lot of hacked IoT devices used to ...
David Rivas's user avatar
1 vote
0 answers
147 views

How to (easily?) protect a mobile authentication endpoint?

I'm creating an app that runs both on the web and on mobile (loads offline files through cordova inside a webview) For my user's login forms in the web vesion, I use google captcha to protect ...
sigmaxf's user avatar
  • 643
5 votes
1 answer
889 views

Unusual GET Request

I am getting unusual get requests to my server: /op69okl?name=http://www.ntdtv.com/ or /op69okl?name=http://www.epochtimes.com/ or something similar with other sites in the param. Doing some searching ...
Serge Poele's user avatar
3 votes
0 answers
313 views

Security Risks specific to IPv6-only hosts

Because I can get full IPv6 support now from my home office (Comcast did this right) I have started to bring up cloud servers with no IPv4 addresses -- only IPv6. I use a static address and create a ...
AlanObject's user avatar
1 vote
3 answers
655 views

Risks of deploying MIRAI on my local network for testing?

Once again for research purposes I would like to "release" the MIRAI botnet on an IoT subnetwork in my home. However I am unsure of the consequences that this may have (e.g. damage my devices). What ...
Irene Ant's user avatar
  • 669
2 votes
0 answers
102 views

How does Mirai (or any IoT malware) perform the initial infection? [duplicate]

From what I understand, Mirai and other related IoT malware use already infected bots to perform the scanning of various IPs for open ports to find potential new victims. How is the first bot infected ...
dapirateking's user avatar
2 votes
2 answers
1k views

Is it still possible to run an online dictionary attack from a single machine, without anonymisation?

This question concerns dictionary attacks conducted: Over the Internet, using programs like THC Hydra Via protocols such as HTTP, FTP and SMTP I believe I'm right in thinking that: a) due to the ...
Hashim Aziz's user avatar
0 votes
1 answer
97 views

Are emails from the Necurs bot net DKIM and/or SPF signed?

As the questions title already asks: Are emails sent by Necurs DKIM and/or SPF signed? Or are they unsigned and simply spoofed?
user165355's user avatar
-1 votes
1 answer
243 views

Can I identify which botnet is attacking my service?

My service is seeing a fairly sophisticated attack that is distributed across multiple IP addresses. I have a list of 'rogue' IP addresses. They are distributed all around the world. Is there some way ...
Manish's user avatar
  • 199
0 votes
1 answer
144 views

Finding/Predicting BotNet Generated Domains Without DGA Knowledge

I will pose an academic perspective in my question, but I welcome any and every observation. So a botnet would generate 1000s of domain/day and an actual attacker will register a few, which will be ...
Jishan's user avatar
  • 203
-1 votes
2 answers
241 views

Botnet callbacks to coin mining sites - how to act? [closed]

I found that one user is making connections to coin mining related domains. Is there any way to stop this activity, with respect to that user?
praj's user avatar
  • 7
2 votes
2 answers
243 views

Is there a way to prevent comments from being abused for command and control?

Botnets typically are coordinated over protocols like HTTP or IRC. However, to make such command and control traffic harder to spot, attackers have occasionally turned to other channels, including ...
Cody P's user avatar
  • 1,148
3 votes
1 answer
503 views

How does a botnet update?

So recently I started to study how botnets work. But recently I stumbled onto a problem. I even tried brain storming how it would do it, but I couldn't think how a bot would update its code. I also ...
Fumerian Gaming's user avatar