ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “botnet”

3 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 2178Ransomware 1308Exploit / PoC 1064Vulnerability 838Data breach 313Policy & legal 262Threat actor 248Phishing & fraud 186Advisory 32AI safety & security 16Research 12Industry 12AI research 3Tools 3
SeverityAllcritical 3394high 1692medium 1115low 244info 34

NETSCOUT expands Adaptive DDoS Protection with outbound attack mitigation

NETSCOUT extended Adaptive DDoS Protection to detect and mitigate outbound DDoS traffic at source, targeting IoT botnet attacks like Turbo-Mirai.

NETSCOUT announced an extension of its Adaptive DDoS Protection (ADP) for service providers to automatically detect and mitigate outbound DDoS traffic from compromised subscriber devices such as broadband routers and IoT devices. The capability addresses Turbo-Mirai-class botnets capable of multi-terabit attacks and integrates with Arbor Sightline, Arbor Threat Mitigation System, the ATLAS Intelligence Feed, and ASERT analysts. Source-side mitigation aims to reduce outages, transit costs, peering damage, and abuse complaints at ISPs.

Help Net Security · 29d agoTools

Bulk AbuseIPDB reporting using command-line tools

A blogger shows how to bulk-report distributed botnet IPs scraping a self-hosted Gitea instance to AbuseIPDB using bash, awk, and jq.

The author's self-hosted Gitea instance was scraped by distributed bots using random IPs worldwide and randomized, often nonexistent User-Agent strings, generating heavy request load for days. The write-up demonstrates filtering Traefik access logs (CLF and JSON) with grep, awk, and jq to extract offending IPs, tagging them with AbuseIPDB category 19 (Bad Web Bot), deduplicating them, and building a CSV for the Bulk Reporter tool. Reports can then be submitted through the AbuseIPDB bulk-report API, respecting the 5,000-report daily limit.

Lobsters · security · 6d agoTools1

Honeypot-Omaha and batch.py [Guest Diary], (Wed, Sep 2nd)

A SANS ISC guest diary describes batch.py, a Python tool that consolidates honeypot logs and enriches IOCs with threat intelligence data.

Written by a SANS.edu BACS intern, the diary explains analysis of the DShield Honeypot-Omaha sensor, which uses Cowrie to emulate SSH and Telnet and log attacker activity. The author's batch.py script implements a four-phase pipeline with SHA-256-generated master and guest authentication to consolidate JSON and log files, correlate data via external APIs, and produce MITRE, CVE, geolocation, threat-score and fingerprint enrichment for investigated indicators.

SANS Internet Storm Center · 13d agoTools1