Adversary DNA: we named the botnet
From one suspicious request to a named Mirai botnet at 0.91 confidence, with the evidence chain and an incident Claude triages on its own.
Direct attributionLocal sensor93 s
02 · Direct attribution
Not “this IP is bad”. What it is, why, and how sure.
A reputation lookup gives you a verdict. Our attribution engine gives you a name, a confidence score and the evidence behind it. Independent evidence is combined, and nothing is asserted without it. If the graph can't prove an actor, it names none.
- E1 · IOCOur threat intel had the IP serving Mirai builds for every IoT CPU, matched through the payload URL, not just a bare IP.
- E2 · /242,344 known-bad indicators in its neighbourhood, 1,274 of them Mirai.
- E3–E6Cited botnet tradecraft, actor bridges, shared behavioural DNA, coordinated campaigns.
0.91HIGH1 − (1−0.85)(1−0.40)
