Shadowserver, shame on you!
Most of you who've read this blog before know me. So how the fuck am I being accused that MY network is infected and part of a BOTNET? These are serious accusations. DIGI told me straight to my face, by email, that I could lose my contract, and I explained to the lady on the phone too that this is a serious accusation!
And this way anyone can find out my IP, file a report with an empty dst_ip and say: THIS USER IS DDOSING US, HAS A BOTNET, SSH BRUTEFORCE, etc. That's how you spam reports on a conveyor belt and get contracts suspended.
So apparently my house is a botnet now. Nice to know. Nobody told me, not even my own computers.
This week DIGI, my internet provider, sent me an email titled "Alerta Infosec DIGI", tagged trojan/botnet ssh-brute-force. According to them, one of my devices is infected, part of a botnet used for scanning, brute force and DDoS, and might be stealing bank details and sending phishing on the side. And if more reports come in, they may filter my ports or cut my connection.
Where does this come from? A report from Shadowserver, a nonprofit that runs sensors around the internet and sends what they catch to ISPs, who then forward it to people like me with a nice scary template on top.
The "evidence"
Here it is. All of it. This is everything they've got:
timestamp: 2026-11-02 14:58:40 UTC
src_ip: 188.27.180.x (my home IP, masked here)
src_port: 59459
dst_ip:
dst_port: 22
protocol: tcp
tag: ssh-brute-force
Look at dst_ip. It's fucking empty.
I'm accused of brute-forcing SSH and the report can't even say who I attacked. No target. No number of attempts. No time span. One timestamp, one port number, and a scary word. That's the whole case.
They don't even know what they're accusing me of
Read the email again: "one of your devices is infected with the malware ssh-brute-force". There is no malware called ssh-brute-force. It's a tag. It means "something tried to log in over SSH". They took a label for a behaviour and turned it into the name of a virus.
And then it keeps going: botnet, scanning, DDoS, stealing bank details, phishing, spam. All of that from one connection to port 22.
So my house is a botnet, and the botnet also brute-forces SSH, and also steals bank cards, and also sends spam? Make up your fucking mind. They don't even know what they're talking about.
I asked. Nobody knows shit.
I called DIGI and asked the obvious question: what IP did I supposedly attack? Answer: Shadowserver doesn't provide it.
So let me get this straight. I'm being accused, my ISP is threatening to cut my contract, and nobody can tell me what I did or to whom. Not me, not DIGI, nobody outside Shadowserver. You can't defend yourself against a blank field.
So I did their job for free
Instead of ignoring it, I went through every computer in the house:
- Mac: no malware, no scanning tools, nothing weird starting by itself. Every SSH connection it makes goes to servers I own.
- Linux laptop: clean. Its system log for that exact afternoon shows Wi-Fi scanning and that's it. Zero SSH.
- Windows PC: it was switched off. The system log stops at 00:11 on 2 November and the next entry is the boot at 00:43 on 3 November. The "attack" was at 16:58 local time. So the one machine that could've been quietly infected was literally off.
- iPhone: the only SSH it ever does is me, in Termius, connecting to my own servers. A phone isn't running a brute-force botnet.
- From the outside: nothing on my network is reachable from the internet. No open ports, no port forwarding.
That's every device I have. So if none of them sent that SSH connection, who did? Casper the Friendly Ghost? Really?
Not to mention that my reputation on Shodan and AbuseIPDB is clean. Oh, sure. That doesn't mean anything, right?
And here's my router. No port forwarding, no port triggering, DMZ off, UPnP off with zero clients. Why? Because I'm not dumb enough to do that.
That's hours of my life spent proving a negative because someone left a field blank.
What a botnet actually is
Since they threw the word around, let's explain it properly.
A botnet is a bunch of infected devices controlled by one attacker. Each infected device (a "bot") connects to the attacker's command server, waits for orders and carries them out: flood a website (DDoS), send spam, scan the internet, guess passwords. The owners usually have no idea it's happening.
Most bots aren't laptops. They're cheap IP cameras, DVRs and old routers that still use their default password or have a hole nobody patched. The best-known one, Mirai, took over hundreds of thousands of cameras and routers in 2016 just by trying default passwords over telnet. That's why DIGI's template tells you to change your DVR password and close telnet: it was written for that kind of device.
And a bot doesn't take breaks. Once it's infected, it works for the botnet all day, every day, until someone cleans it up.
What SSH brute force actually looks like
SSH is how you log in to a server remotely, normally on port 22. Brute force means guessing logins over and over: root/123456, admin/admin, root/password, thousands of combinations, against thousands of servers.
A bot doing this first scans huge chunks of the internet for anything answering on port 22, then hammers each one with login attempts. From the outside it looks like a constant stream of connections to port 22 on lots of different IPs, for hours or days.
Anyone who runs a server has seen it. Open the SSH log on a fresh server and within minutes it's full of failed logins from all over the world. Many of those servers run tools like fail2ban, which ban the attacker and report the IP to AbuseIPDB automatically. That's how brute-forcing IPs end up with hundreds of reports there within days.
Why it wasn't me
- One connection isn't brute force. The report has one timestamp and one source port. Real brute force is thousands of attempts. One connection to port 22 is what happens every single time anyone opens SSH.
- No bot, anywhere. I checked every device. Nothing unknown running, nothing starting by itself, no strange outgoing connections. The Windows PC was switched off. The iPhone can't run a scanner in the background, because iOS doesn't let apps do that.
- No way in from outside. No port forwarding, no DMZ, no UPnP. Nothing on my network is reachable from the internet.
- No reports anywhere. A real bot brute-forcing SSH gets reported by the servers it hits, and fast. My IP has zero reports on AbuseIPDB. Zero.
So: one connection, from a network with no infected device, no open door and a clean reputation, and that's a "trojan/botnet". Sure.
What's fucked up here
I'm not saying Shadowserver's sensors are fake. Maybe they saw a connection. Fine. What's fucked up is what happens next:
- One event gets you called a botnet. A single connection to port 22, no target, no count, and suddenly you're "trojan/botnet". You know what else looks like one SSH connection from the other side? A mistyped IP. An old server that changed owners. A client retrying a login. Normal shit.
- The accused can't see the evidence. If you tell me my network attacked something, tell me what. Otherwise there's nothing to fix, nothing to check, and nothing to defend against. That's not security, that's an accusation with a logo on it.
- The ISP threatens first and checks never. DIGI forwards a line they can't verify themselves, slaps "trojan/botnet" on it, and adds a threat to cut my internet. The advice that comes with it (change your DVR password, close telnet) is the same copy-paste template everyone gets.
What I want
Shadowserver: put the destination and the number of attempts in your reports, or give them to the person you're accusing when they ask. And stop letting a single event go out the door as a botnet infection.
DIGI: don't threaten your customers with disconnection over a report you can't verify. If you send one, send the details too. And maybe read it before you forward it.
And if they filter me?
Here's the real problem: what happens if they filter my internet? I connect to my company over WireGuard and to my own servers over SSH. If I end up unable to work because of a report nobody can verify, I'll do everything I can to report Shadowserver wherever I can for this shit.
They fucked with the wrong guy.
Update, 5 November: I've sent Shadowserver a formal GDPR data access request (Article 15) asking for everything they hold on my IP: the destination, the number of attempts, and who they shared it with. By law they have one month to answer, so until 5 December 2026. If they answer, I'll update this post. I'm not holding my breath.
Update 2, 5 November: DIGI's technical team called me. Their conclusion? Reply to the email. That's it. The technician admitted that they don't have anything more than what they sent me, when I asked where the connection came from he literally said "I don't know", the contract only gets cut "if the abuse persists", and no other report has come in since. So it was something "temporary". For that, I got threatened with having my connection blocked.
So I'm replying with the full analysis above and asking for three things: close the report as a false positive and confirm in writing that nobody touches my connection or my contract, send me the full evidence if the report stays open (destination IP, number of attempts, logs), and check their own router, the EX520 with their firmware that I can't update. When they answer, I'll update this post.
Call transcript
I recorded the call myself. I'm not publishing the technician's voice or name: he's doing his job, the problem is the report, not him. Translated from Romanian, stammers removed.
DIGI: From what I see there, it says something about port 59459 and port 22. You don't know what you have open and what's behind them.
Me: I have nothing open. That's the problem. I checked everywhere, on every device in the house, and none of them sent an SSH connection in that time window. That's why I'm asking: where does the report come from?
DIGI: Yeah, I don't know. That's why it's best to write to my colleagues at [email protected], and they'll see if more reports show up. Because that's all we got too, what we sent you.
Me: I see. So there can be false positives from Shadowserver, I've seen they're pretty well known for this kind of crap.
DIGI: Still, best thing, please, reply to my colleagues. Say you found nothing and everything you did.
Me: So I can't end up, for example, I read on digi.ro, with my contract cut over reports like this?
DIGI: Only if the abuse persists. You understand we're obliged to [unclear] block it.
Me: That's not the case. In 2 years with DIGI, this is the first email like this I've ever gotten.
DIGI: Sure, no problem. But you know, some people have malware, it can be all sorts of things, or it can be something else. That's why it's best you check locally too, especially on residential, where the IP can change.
Me: Yeah, and on residential there's also the spoofing problem.
DIGI: Yeah, there are lots of things. Reply to my colleagues and wait. But clearly it was something temporary, because I see no other reports came in. If they had, you can imagine we'd have been on the phone with you.
Me: Yeah, and AbuseIPDB would have been full of logs too, but there's nothing anywhere.
DIGI: And on Shodan.
Me: Yeah, on Shodan too, no results.
DIGI: Alright, then write to my colleagues and they'll look into it.
To sum up: the source port is ephemeral, port 22 is SSH, the destination IP is missing, DIGI has nothing more, no other reports came in. And still, step one was an email saying "botnet" and a threat to block my connection.
Update 3, 5 November: for everyone still saying "maybe there's something on your network": I scanned the whole network, inside and out. All 65,535 TCP ports on IPv4 from the internet: 0 open. IPv6: blocked. Every device checked from the inside, the logs at the time of the report checked, the PC was off. The only thing nobody but DIGI can check is their router, which runs TR-069 (remote management) and a 2023 dnsmasq with vulnerabilities fixed since.
The full report (in Romanian), IP masked: raport-securitate-retea.pdf
And so this never needs doing again: from today, every new connection is logged in real time in Grafana, with alerts on brute-force patterns (many SSH attempts per minute to one server, or SSH to dozens of different servers). It sits at 0.
Update 4, 5 November: I spoke with DIGI's security team. Their conclusion: most likely a false positive, a wrongly entered IP. "It can happen," the technician told me.
So, to sum it up: an email saying "botnet", a threat to block my connection, a day lost scanning and a night of stress, for a false positive. At least it ended well, and I came out of the whole thing with monitoring on my network.
And I'm not the only one. On Reddit, several other DIGI customers said they got exactly the same kind of email, also based on Shadowserver reports, and were also told to "reply to the email" when they called. One of them at least got a report with a destination IP. I got an empty field.
The GDPR request to Shadowserver still stands. If they answer by 5 December, I'll update this post.
From now on, even if it costs me +30 ping, I'll stay on the VPNs inside my own ASN, so I stop getting pointless accusations. If there's no other way, so be it.
Oh wait, not being on my own IP will probably look suspicious too. /s
And honestly, now I regret not having a MikroTik anymore. I'm buying one again and putting it in as my main router, because as I can see, I can't trust DIGI. It'll log every outgoing connection, so the next time someone accuses me of something with an empty dst_ip, I'll know in seconds what left my network and what didn't.
I have always been honest, legit and legal. And I'm not letting anyone call me a botnet with an empty field as proof.
P.S. for DIGI: Do you take me for an idiot? You send me advice about firmware updates, antivirus scans and the rest, when I run the most secure network possible. Seriously?
Why the fuck does random shit like this always happen to me... :/
Comments