Skip to content

ogurexxx@root:~$ grep -f botnets.txt auth.log

Log check

Paste a piece of /var/log/auth.log or the command history from your server. The browser checks it against the botnets my honeypot caught and against common attacker techniques.

What is checked

Commands are compared with the bestiary families: if your history looks like their script, you get a link to the description.
Typical techniques: a key in authorized_keys, cron jobs, downloading and running a script, wiping history, miners, disabling the firewall.
In auth.log: how many failed logins there were and whether a login succeeded from an address that was guessing passwords before.

The check only knows what this server's honeypot has seen. An empty result does not mean the system is clean.