Skip to content

Botnet.cl - Live Botnet Monitoring and BGP Feed#

NANOG 98 digest Program Adjacent pick 19–21 October 2026

Abstract Slides Recording

Rodrigo Peña – Bitred Group SpA

Play the recording: Botnet.cl - Live Botnet Monitoring and BGP Feed

  • Why: A ten-minute lightning talk, but a live example of AI-assisted security operations with community distribution — 115 ISPs subscribed in two months.
  • What: A protocol emulator (with AI-assisted recovery of C2 protocols) registers and heartbeats into botnet C2 servers, logging commands; ADB sinks capture Android malware acquisition paths. Observations become a BGP feed: 25 confirmed C2 IPs across 25 botnet families, distributed as IPv4 /32 routes tagged with the BLACKHOLE-style community 65535:666, origin ASN, and botnet-family metadata.
  • How: Emulation-first intelligence gathering (no need to run real bots at scale), then per-C2-IP blackhole announcements that member ISPs apply themselves.
  • Where applicable: Chile-origin effort but the pattern — a shared, metadata-rich blackhole feed — is general; the talk is thin on method detail (from slides only).