Questions tagged [botnet]

A botnet is a collection of computers that are under the control of a person or group, usually facilitated by malware. These computers are often used to take part in DDoS attacks and spamming.

Filter by
Sorted by
Tagged with
0 votes
0 answers
38 views

Malware sinkhole evasion techniques

I have read into malware sink holing, as a way to disrupt botnets. There are also approaches to make this more difficult, for example using a Domain Name Generator algorithm which is what the ...
user avatar
0 votes
0 answers
34 views

Increment hearbeat request metasploit

I'm using metasploit to a university project and I have to try to make a botnet attack unnoticed and the if the blue team dettect it, I have t try to make as imposible as I can to attribute the attack....
user avatar
  • 5
5 votes
0 answers
146 views

Why am seeing all these Chinese proxy domains? [closed]

Through a casual Google search I came to this Stack Overflow result. I clicked it absent-mindedly, could not connect through the server and saw that he domain was some Chinese government proxy server. ...
user avatar
  • 151
0 votes
1 answer
120 views

Why do DDoS attacks spoof DNS source IPs?

Recently, a lot of my friends have been talking about botnets. They said they've created their own.‌‌ Obviously, I ​​know this is all illegal so I try not to take part in any of it. But I've been ...
user avatar
27 votes
2 answers
9k views

How is Google abused for DDoS attacks?

While analysing a DDoS attack on my site using CloudFlare console, I've noticed that many attack requests come from AS139190 GOOGLE-AS-AP Google Asia Pacific Pte. Ltd. with Empty user agent. I'm ...
user avatar
  • 383
0 votes
1 answer
119 views

Can Mirai scan reach devices behind routers?

I recently saw this article of a version of Mirai being spread to Android based devices via ADB enabled. My question relates to how Mirai does scanning. Lets assume I have a Android based device (like ...
user avatar
  • 1,095
0 votes
1 answer
344 views

Can't free proxies be used to create a botnet?

I recently learned that there are plenty of services on the internet that offer/list free public proxies (freeproxylists.net, hidemyass.com, proxyscrape.com to name a few). Is this safe? Can't an ...
user avatar
  • 47
-1 votes
1 answer
143 views

How was the router compromised? [closed]

ISP sent a message telling that they've detected some bot network characteristic traffic from a router's IP address. Recommended countermeasures have already been taken, i. e. connected laptop's ...
user avatar
  • 3
2 votes
1 answer
224 views

Why do infected hosts scan port 80?

I have my serve set up with AbuseIPDB so I can keep a log of all suspicious request and hacking attempts for my honeypot machine. I noticed an IP that sent a GET request to port 80. 177.154.28.130 - - ...
user avatar
  • 103
1 vote
2 answers
174 views

Do some IoT devices connect to your wifi without you knowing it?

I keep hearing about refrigerators and automated vacuum cleaners being targeted, but do the owners manually configure these devices to connect to their wifi network or do the devices have a work ...
user avatar
1 vote
1 answer
151 views

Why do bots visit my website even though it hasn't been shared with anyone yet?

Is this usual? These bots hit my website every 15 minutes and they're the only visitors I get since I haven't shared the website with anyone yet... How do they even know about my website? What is the ...
user avatar
0 votes
0 answers
96 views

DDoS in form of bad bots?

Recently, one of my servers came under attack by DDoSing it. After inspection of access logs, I can only find one common denominator: Referrer. All of request come with (I assume) fake referrer: ...
user avatar
1 vote
0 answers
117 views

How are accountgenerators with captchas still possible?

I was asking myself, how there are still account generators (e.g. for Steam) wide available for everyone. With account generators I mean programs, that are automatically creating a huge amount of ...
user avatar
0 votes
1 answer
120 views

Using opensource C2 dangers

I've been playing around with some of the C2's available at GitHub that I've found at https://www.thec2matrix.com/matrix It's cool to play around with tons of Linux machines I own and send them ...
user avatar
  • 155
1 vote
1 answer
136 views

Why attacker do not care about masking the IP of the infected device of botnet?

I get a sentence: If an attack is created using a botnet the likelihood of tracking the attack back to its source is low. For an added level of obfuscation, an attacker may have each distributed ...
user avatar
  • 925
1 vote
1 answer
115 views

What does "hijack" mean in networking security?

How should I understand the word "hijack" in network security? In Cloudflare's page about the Mirai botnet, there is a sentence: The Mirai botnet employed a hundred thousand hijacked IoT devices ...
user avatar
  • 925
1 vote
1 answer
183 views

How do botnets self-propogate exactly?

I am learning about malware and botnets and came across that botnets can "self-propogate" and I am confused as to how they can do this. I know that a botnet can be created through multiple people ...
user avatar
  • 113
1 vote
1 answer
160 views

Why fingerprint a browser if a fingerprint can be replayed?

I'm facing an issue with rampant scraping and abuse on a website that costs me a good chunk of money to maintain. So, I have been looking to implement a few solutions, and apparently these solutions ...
user avatar
85 votes
10 answers
17k views

How and why is my site being abused?

I own a popular website that allows people to enter a phone number and get information back about that phone number, such as the name of the phone carrier. It's a free service, but it costs us money ...
user avatar
  • 699
30 votes
10 answers
9k views

Received email from ISP saying one of my devices has malware

My dad received a suspicious email from our ISP (mtnl.net.in). The email was from noreply@mtnl.net.in and it had our user ID (I masked it as xxxxxxxx@a) in the email so it must have come from the ISP ...
user avatar
  • 453
0 votes
1 answer
398 views

Malicious IP addresses [closed]

I am looking for updated lists of IP addresses that belong to malware's C&C, botnets, malicious scanners, or other sort of malicious activities. Is there any public database of malicious IP ...
user avatar
  • 31
-3 votes
2 answers
159 views

What's the main constituent part of botnet?

Is the botnet controlled broiler of servers or personal PCs? We know the botnet can be controlled to DDoS attack, but what's the main constituent part of botnet? I know the botnet's element maybe PC,...
user avatar
  • 925
82 votes
5 answers
14k views

Email Account under attack (really) - anything I can do?

Over the last week, there is a constant barrage of authentication failures to my email account from a variety of ip addresses - usually in blocks of exactly 575 attempts. My password is as strong as ...
user avatar
  • 831
2 votes
2 answers
631 views

Zeus v3 - can I detect its existence "manually"?

A firewall in my company was triggered by a DNS query from one of our laptops. Specifically, the exact reason was MALWARE-CNC Win.Trojan.Zeus v3 DGA DNS query detected. Now, I could just follow this ...
user avatar
  • 380
1 vote
0 answers
98 views

Question on a decentralized botnet, is this technically how communications would flow? (Flowchart)

I am trying to get into and researching botnets, to help myself learn and others prevent attacks. First thing is understanding how decentralized botnet's work. I asked a question yesterday explaining ...
user avatar
  • 115
0 votes
1 answer
213 views

How does the server-client scheme work in a botnet?

I am having trouble wrapping my head around the idea on how a server-client botnet structure actually works. Let's say that the server is A, and the client is B. We know A is listening always on ...
user avatar
  • 115
2 votes
2 answers
927 views

Server getting probed: why can I see successful GET requests to other sites?

I put up my site yesterday and this morning I saw a lot of requests in the logs. I have seen this before, and immediately could tell it was someone/something probing the server. Most of the requests ...
user avatar
  • 785
1 vote
2 answers
205 views

Are botnet nodes made to stop working during office hours?

Some network guys at my work seem to think that a client that we monitor may be part of a botnet, but the spike in traffic that we see at night always stops at the latest around 8am in time for office ...
user avatar
  • 13
2 votes
1 answer
231 views

Honeypot SSH connection attempts with no interaction

I am seeing a lot (>50% of total events) of connection events on a honeypot I have set up but there is no further interaction, no brute force, just a connect then disconnect. I'm thinking this is ...
user avatar
-1 votes
2 answers
429 views

Which are the most dangerous and popular botnets that came from IoT devices?

The ease of taking control of a cheap IoT device makes them the perfect target to craft a botnet to perform DDoS attacks. I heard about botnets created from a lot of hacked IoT devices used to ...
user avatar
1 vote
0 answers
91 views

How to (easily?) protect a mobile authentication endpoint?

I'm creating an app that runs both on the web and on mobile (loads offline files through cordova inside a webview) For my user's login forms in the web vesion, I use google captcha to protect ...
user avatar
  • 623
5 votes
1 answer
776 views

Unusual GET Request

I am getting unusual get requests to my server: /op69okl?name=http://www.ntdtv.com/ or /op69okl?name=http://www.epochtimes.com/ or something similar with other sites in the param. Doing some searching ...
user avatar
3 votes
0 answers
251 views

Security Risks specific to IPv6-only hosts

Because I can get full IPv6 support now from my home office (Comcast did this right) I have started to bring up cloud servers with no IPv4 addresses -- only IPv6. I use a static address and create a ...
user avatar
1 vote
3 answers
580 views

Risks of deploying MIRAI on my local network for testing?

Once again for research purposes I would like to "release" the MIRAI botnet on an IoT subnetwork in my home. However I am unsure of the consequences that this may have (e.g. damage my devices). What ...
user avatar
  • 659
2 votes
0 answers
97 views

How does Mirai (or any IoT malware) perform the initial infection? [duplicate]

From what I understand, Mirai and other related IoT malware use already infected bots to perform the scanning of various IPs for open ports to find potential new victims. How is the first bot infected ...
user avatar
2 votes
2 answers
1k views

Is it still possible to run an online dictionary attack from a single machine, without anonymisation?

This question concerns dictionary attacks conducted: Over the Internet, using programs like THC Hydra Via protocols such as HTTP, FTP and SMTP I believe I'm right in thinking that: a) due to the ...
user avatar
0 votes
1 answer
73 views

Are emails from the Necurs bot net DKIM and/or SPF signed?

As the questions title already asks: Are emails sent by Necurs DKIM and/or SPF signed? Or are they unsigned and simply spoofed?
user avatar
-1 votes
1 answer
182 views

Can I identify which botnet is attacking my service?

My service is seeing a fairly sophisticated attack that is distributed across multiple IP addresses. I have a list of 'rogue' IP addresses. They are distributed all around the world. Is there some way ...
user avatar
  • 189
0 votes
1 answer
120 views

Finding/Predicting BotNet Generated Domains Without DGA Knowledge

I will pose an academic perspective in my question, but I welcome any and every observation. So a botnet would generate 1000s of domain/day and an actual attacker will register a few, which will be ...
user avatar
  • 193
-1 votes
2 answers
208 views

Botnet callbacks to coin mining sites - how to act? [closed]

I found that one user is making connections to coin mining related domains. Is there any way to stop this activity, with respect to that user?
user avatar
  • 7
2 votes
2 answers
217 views

Is there a way to prevent comments from being abused for command and control?

Botnets typically are coordinated over protocols like HTTP or IRC. However, to make such command and control traffic harder to spot, attackers have occasionally turned to other channels, including ...
user avatar
  • 1,148
3 votes
1 answer
451 views

How does a botnet update?

So recently I started to study how botnets work. But recently I stumbled onto a problem. I even tried brain storming how it would do it, but I couldn't think how a bot would update its code. I also ...
user avatar
2 votes
1 answer
502 views

What to do when my router is infected with a malware (becoming a part of a botnet)?

Backstory Few years ago I bought an Aztech DSL5005 ADSL router, it was the only router available which I could verify I can telnet to and get a proper Linux environment (I wanted an OpenWRT enabled ...
user avatar
  • 121
4 votes
3 answers
3k views

How does Malware use Unregistered Domains

I just finished reading that the WannaDecryptor malware was querying an unregistered domain. I thought it was connecting to its command and control server. Is this correct? It is my understanding ...
user avatar
  • 143
0 votes
2 answers
1k views

How Mirai scans or find targets [duplicate]

I read some articles about the Mirai botnet. I can't understand how Mirai scans/finds IoT devices. Does Mirai scan the entire public IP range with an open telnet port and try to log in?
user avatar
  • 11
3 votes
1 answer
140 views

Dangers of Botnet Scanning Traffic?

Are there any dangers to seeing small amounts of botnet/malware associated traffic crawling your public facing infrastructure? For instance seeing the same malware associated IP making different ...
user avatar
  • 31
4 votes
1 answer
161 views

One computer on our network was hacked and stole hundreds of accounts on different websites - what are correct steps to take?

Someone in our company long time ago downloaded infected Windows Server copy from torrent site and kept it as test server in our network till now. Recently, our administrator noticed huge outgoing ...
user avatar
0 votes
2 answers
202 views

Where to find current, live botnet executable clients

I've been able to find readily available botnet source code online however I'm currently working on my university research project and require access to an actual botnet client which encompases DGA's (...
user avatar
5 votes
2 answers
4k views

How does Mirai's C&C communicate with its bots?

I'm wondering how Mirai based botnets work. Specifically, I want to understand the communication mechanisms between the C&C servers and its bots. After reading this question I've understood that a ...
user avatar
  • 115
-4 votes
2 answers
1k views

remove mirai virus on router

I need some help with removing the mirai worm on my rounter. Few days ago my ISP was on cyberattacks which it have affected over 100,000 customers who couldn't be able to get access to the internet ...
user avatar
  • 1