We collected 470K IPv4s from a botnet that was trying to get all the content from our social network; it was behaving in such a way that we could track every single request it made. Since we blocked it, the server has been working much better; it hasn’t been running with such a low load for at least a year.
▻https://framapiaf.org/@biggrizzly/114227612269042897
Can you try to use the ipset and tell us if it works ? Reply on seenthis or on mastodon, tagging ►https://seenthis.net/people/biggrizzly or ▻https://framapiaf.org/@biggrizzly
Here is the latest file, more than 540K /32.
►https://www.partagerfichier.fr/download.php?f=2025-04-03-17-53-54_botnet-set.zip
It’s an ipset backup (►https://ipset.netfilter.org/ipset.man.html).
You can restore the file using this command line :
ipset restore -file ./botnet-set
You can declare it in iptables, using this command line :
iptables -A INPUT -m set --match-set botnet-set src -j DROP
