10 ms·

I have this problem right now. A botnet found one of my computers. Most likely through IRC. They have been trying relentlessly to get my computer added. They

by younata 16y ago

I have this problem right now. A botnet found one of my computers. Most likely through IRC. They have been trying relentlessly to get my computer added. They have no chance of getting in - using public key authentication - but it still takes quite a toll on my network speed. That said, I have a file containing about 366 IPs belonging to this botnet, as well as a half-meg file containing nmap scans of all these IPs. What should I do with it?

iuguy 16y ago
With the places you access the computer from do you use dynamic or static IP addresses? If they're all static IP addresses, try to block everything on port 22 except for your static IPs. If it's dynamic you should have a pool address block, you can add the block in but there's a risk that if your block is in an ISPs home user pool that the botnet could infect people in your block. If you can't use upstream filtering then I'd suggest you configure a firewall to do the same thing, either in hardware (preferable) or software.