Questions tagged [botnet]

A botnet is a collection of computers that are under the control of a person or group, usually facilitated by malware. These computers are often used to take part in DDoS attacks and spamming.

Filter by
Sorted by
Tagged with
0 votes
1 answer
53 views

Preventing Signup API abuse from botnet

I am working on an e-commerce website, wherein make use of mobile OTP authentication for new signups. We have a fair bit of protection against bots and malicious actors by using aggressive rate ...
  • 139
0 votes
2 answers
146 views

How are IoT botnets even a thing when the only write-able folder is /var or /tmp and both gets reset every restart?

This "No Persistence" and having to re-infect again after every reboot seems so inefficient for IoT to be such pursued targets. Also, most of the persistence methods I have seen tend to be ...
  • 15
0 votes
0 answers
48 views

Malware sinkhole evasion techniques

I have read into malware sink holing, as a way to disrupt botnets. There are also approaches to make this more difficult, for example using a Domain Name Generator algorithm which is what the ...
0 votes
0 answers
48 views

Increment hearbeat request metasploit

I'm using metasploit to a university project and I have to try to make a botnet attack unnoticed. If the blue team detects it, I have to try to make as imposible as I can to attribute the attack. I'm ...
  • 5
5 votes
0 answers
218 views

Why am seeing all these Chinese proxy domains? [closed]

Through a casual Google search I came to this Stack Overflow result. I clicked it absent-mindedly, could not connect through the server and saw that he domain was some Chinese government proxy server. ...
  • 151
0 votes
1 answer
127 views

Why do DDoS attacks spoof DNS source IPs?

Recently, a lot of my friends have been talking about botnets. They said they've created their own.‌‌ Obviously, I ​​know this is all illegal so I try not to take part in any of it. But I've been ...
27 votes
2 answers
9k views

How is Google abused for DDoS attacks?

While analysing a DDoS attack on my site using CloudFlare console, I've noticed that many attack requests come from AS139190 GOOGLE-AS-AP Google Asia Pacific Pte. Ltd. with Empty user agent. I'm ...
  • 383
0 votes
1 answer
128 views

Can Mirai scan reach devices behind routers?

I recently saw this article of a version of Mirai being spread to Android based devices via ADB enabled. My question relates to how Mirai does scanning. Lets assume I have a Android based device (like ...
  • 1,095
0 votes
1 answer
459 views

Can't free proxies be used to create a botnet?

I recently learned that there are plenty of services on the internet that offer/list free public proxies (freeproxylists.net, hidemyass.com, proxyscrape.com to name a few). Is this safe? Can't an ...
  • 47
-1 votes
1 answer
167 views

How was the router compromised? [closed]

ISP sent a message telling that they've detected some bot network characteristic traffic from a router's IP address. Recommended countermeasures have already been taken, i. e. connected laptop's ...
  • 3
2 votes
1 answer
249 views

Why do infected hosts scan port 80?

I have my serve set up with AbuseIPDB so I can keep a log of all suspicious request and hacking attempts for my honeypot machine. I noticed an IP that sent a GET request to port 80. 177.154.28.130 - - ...
  • 103
1 vote
2 answers
187 views

Do some IoT devices connect to your wifi without you knowing it?

I keep hearing about refrigerators and automated vacuum cleaners being targeted, but do the owners manually configure these devices to connect to their wifi network or do the devices have a work ...
1 vote
1 answer
157 views

Why do bots visit my website even though it hasn't been shared with anyone yet?

Is this usual? These bots hit my website every 15 minutes and they're the only visitors I get since I haven't shared the website with anyone yet... How do they even know about my website? What is the ...
0 votes
0 answers
100 views

DDoS in form of bad bots?

Recently, one of my servers came under attack by DDoSing it. After inspection of access logs, I can only find one common denominator: Referrer. All of request come with (I assume) fake referrer: ...
1 vote
0 answers
118 views

How are accountgenerators with captchas still possible?

I was asking myself, how there are still account generators (e.g. for Steam) wide available for everyone. With account generators I mean programs, that are automatically creating a huge amount of ...
0 votes
1 answer
123 views

Using opensource C2 dangers

I've been playing around with some of the C2's available at GitHub that I've found at https://www.thec2matrix.com/matrix It's cool to play around with tons of Linux machines I own and send them ...
  • 155
1 vote
1 answer
143 views

Why attacker do not care about masking the IP of the infected device of botnet?

I get a sentence: If an attack is created using a botnet the likelihood of tracking the attack back to its source is low. For an added level of obfuscation, an attacker may have each distributed ...
  • 935
1 vote
1 answer
118 views

What does "hijack" mean in networking security?

How should I understand the word "hijack" in network security? In Cloudflare's page about the Mirai botnet, there is a sentence: The Mirai botnet employed a hundred thousand hijacked IoT devices ...
  • 935
1 vote
1 answer
193 views

How do botnets self-propogate exactly?

I am learning about malware and botnets and came across that botnets can "self-propogate" and I am confused as to how they can do this. I know that a botnet can be created through multiple people ...
  • 113
1 vote
1 answer
167 views

Why fingerprint a browser if a fingerprint can be replayed?

I'm facing an issue with rampant scraping and abuse on a website that costs me a good chunk of money to maintain. So, I have been looking to implement a few solutions, and apparently these solutions ...
user avatar
85 votes
10 answers
17k views

How and why is my site being abused?

I own a popular website that allows people to enter a phone number and get information back about that phone number, such as the name of the phone carrier. It's a free service, but it costs us money ...
  • 699
30 votes
10 answers
9k views

Received email from ISP saying one of my devices has malware

My dad received a suspicious email from our ISP (mtnl.net.in). The email was from noreply@mtnl.net.in and it had our user ID (I masked it as xxxxxxxx@a) in the email so it must have come from the ISP ...
  • 453
0 votes
1 answer
415 views

Malicious IP addresses [closed]

I am looking for updated lists of IP addresses that belong to malware's C&C, botnets, malicious scanners, or other sort of malicious activities. Is there any public database of malicious IP ...
  • 31
-3 votes
2 answers
163 views

What's the main constituent part of botnet?

Is the botnet controlled broiler of servers or personal PCs? We know the botnet can be controlled to DDoS attack, but what's the main constituent part of botnet? I know the botnet's element maybe PC,...
  • 935
82 votes
5 answers
14k views

Email Account under attack (really) - anything I can do?

Over the last week, there is a constant barrage of authentication failures to my email account from a variety of ip addresses - usually in blocks of exactly 575 attempts. My password is as strong as ...
  • 831
2 votes
2 answers
654 views

Zeus v3 - can I detect its existence "manually"?

A firewall in my company was triggered by a DNS query from one of our laptops. Specifically, the exact reason was MALWARE-CNC Win.Trojan.Zeus v3 DGA DNS query detected. Now, I could just follow this ...
  • 380
1 vote
0 answers
100 views

Question on a decentralized botnet, is this technically how communications would flow? (Flowchart)

I am trying to get into and researching botnets, to help myself learn and others prevent attacks. First thing is understanding how decentralized botnet's work. I asked a question yesterday explaining ...
  • 115
0 votes
1 answer
215 views

How does the server-client scheme work in a botnet?

I am having trouble wrapping my head around the idea on how a server-client botnet structure actually works. Let's say that the server is A, and the client is B. We know A is listening always on ...
  • 115
2 votes
2 answers
991 views

Server getting probed: why can I see successful GET requests to other sites?

I put up my site yesterday and this morning I saw a lot of requests in the logs. I have seen this before, and immediately could tell it was someone/something probing the server. Most of the requests ...
  • 785
1 vote
2 answers
205 views

Are botnet nodes made to stop working during office hours?

Some network guys at my work seem to think that a client that we monitor may be part of a botnet, but the spike in traffic that we see at night always stops at the latest around 8am in time for office ...
  • 13
2 votes
1 answer
241 views

Honeypot SSH connection attempts with no interaction

I am seeing a lot (>50% of total events) of connection events on a honeypot I have set up but there is no further interaction, no brute force, just a connect then disconnect. I'm thinking this is ...
-1 votes
2 answers
432 views

Which are the most dangerous and popular botnets that came from IoT devices?

The ease of taking control of a cheap IoT device makes them the perfect target to craft a botnet to perform DDoS attacks. I heard about botnets created from a lot of hacked IoT devices used to ...
1 vote
0 answers
98 views

How to (easily?) protect a mobile authentication endpoint?

I'm creating an app that runs both on the web and on mobile (loads offline files through cordova inside a webview) For my user's login forms in the web vesion, I use google captcha to protect ...
  • 623
5 votes
1 answer
811 views

Unusual GET Request

I am getting unusual get requests to my server: /op69okl?name=http://www.ntdtv.com/ or /op69okl?name=http://www.epochtimes.com/ or something similar with other sites in the param. Doing some searching ...
3 votes
0 answers
253 views

Security Risks specific to IPv6-only hosts

Because I can get full IPv6 support now from my home office (Comcast did this right) I have started to bring up cloud servers with no IPv4 addresses -- only IPv6. I use a static address and create a ...
1 vote
3 answers
593 views

Risks of deploying MIRAI on my local network for testing?

Once again for research purposes I would like to "release" the MIRAI botnet on an IoT subnetwork in my home. However I am unsure of the consequences that this may have (e.g. damage my devices). What ...
  • 649
2 votes
0 answers
97 views

How does Mirai (or any IoT malware) perform the initial infection? [duplicate]

From what I understand, Mirai and other related IoT malware use already infected bots to perform the scanning of various IPs for open ports to find potential new victims. How is the first bot infected ...
2 votes
2 answers
1k views

Is it still possible to run an online dictionary attack from a single machine, without anonymisation?

This question concerns dictionary attacks conducted: Over the Internet, using programs like THC Hydra Via protocols such as HTTP, FTP and SMTP I believe I'm right in thinking that: a) due to the ...
0 votes
1 answer
74 views

Are emails from the Necurs bot net DKIM and/or SPF signed?

As the questions title already asks: Are emails sent by Necurs DKIM and/or SPF signed? Or are they unsigned and simply spoofed?
-1 votes
1 answer
188 views

Can I identify which botnet is attacking my service?

My service is seeing a fairly sophisticated attack that is distributed across multiple IP addresses. I have a list of 'rogue' IP addresses. They are distributed all around the world. Is there some way ...
  • 189
0 votes
1 answer
121 views

Finding/Predicting BotNet Generated Domains Without DGA Knowledge

I will pose an academic perspective in my question, but I welcome any and every observation. So a botnet would generate 1000s of domain/day and an actual attacker will register a few, which will be ...
  • 193
-1 votes
2 answers
212 views

Botnet callbacks to coin mining sites - how to act? [closed]

I found that one user is making connections to coin mining related domains. Is there any way to stop this activity, with respect to that user?
  • 7
2 votes
2 answers
217 views

Is there a way to prevent comments from being abused for command and control?

Botnets typically are coordinated over protocols like HTTP or IRC. However, to make such command and control traffic harder to spot, attackers have occasionally turned to other channels, including ...
  • 1,148
3 votes
1 answer
462 views

How does a botnet update?

So recently I started to study how botnets work. But recently I stumbled onto a problem. I even tried brain storming how it would do it, but I couldn't think how a bot would update its code. I also ...
2 votes
1 answer
513 views

What to do when my router is infected with a malware (becoming a part of a botnet)?

Backstory Few years ago I bought an Aztech DSL5005 ADSL router, it was the only router available which I could verify I can telnet to and get a proper Linux environment (I wanted an OpenWRT enabled ...
  • 121
4 votes
3 answers
4k views

How does Malware use Unregistered Domains

I just finished reading that the WannaDecryptor malware was querying an unregistered domain. I thought it was connecting to its command and control server. Is this correct? It is my understanding ...
  • 143
0 votes
2 answers
1k views

How Mirai scans or find targets [duplicate]

I read some articles about the Mirai botnet. I can't understand how Mirai scans/finds IoT devices. Does Mirai scan the entire public IP range with an open telnet port and try to log in?
  • 11
3 votes
1 answer
141 views

Dangers of Botnet Scanning Traffic?

Are there any dangers to seeing small amounts of botnet/malware associated traffic crawling your public facing infrastructure? For instance seeing the same malware associated IP making different ...
  • 31
4 votes
1 answer
161 views

One computer on our network was hacked and stole hundreds of accounts on different websites - what are correct steps to take?

Someone in our company long time ago downloaded infected Windows Server copy from torrent site and kept it as test server in our network till now. Recently, our administrator noticed huge outgoing ...
0 votes
2 answers
205 views

Where to find current, live botnet executable clients

I've been able to find readily available botnet source code online however I'm currently working on my university research project and require access to an actual botnet client which encompases DGA's (...