To my knowledge most of the C&C protocols are unsophisticated [0]. For now there is little evidence that says the bots are behind NAT's. I'm pretty sure this w

To my knowledge most of the C&C protocols are unsophisticated [0]. For now there is little evidence that says the bots are behind NAT's. I'm pretty sure this will come though. In the blog post I stated that there is indication that port 23/telnet is or was in past open. Blacklisting IP addresses is indeed effective for L7 attacks. It's harder for L3 when the source IP's could be spoofed. [0] https://medium.com/@cjbarker/mirai-ddos-source-code-review-57269c4a68f https://medium.com/@cjbarker/mirai-ddos-source-code-review-5...