https://blog.efespain.com/en/iranbot/A honeypot in some corner of the network. Every infection, a story worth telling.HugoeneFeSpaineFeSpain2026 eFeSpainTue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-22/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-22/A bot of the Mirai school carries the address of whoever gives it orders. I looked for this one's by four different routes and found it by none — and along the way I published a theory of my own that turned out to be false. What finally worked wasn't a better tool: it was realising that somewhere out there sat another binary, compiled from the same code, whose command centre somebody had already published. With both in front of me, the difference between them is one thousand one hundred and thirty bytes.https://blog.efespain.com/en/chapter-21/Tue, 01 Sep 2026 12:00:00 +0000https://blog.efespain.com/en/chapter-21/An automated scanner found the honeypot's telnet and, eighteen seconds later, there was a binary inside. The password was «telnet». The loader it dropped comes with two operator typos, one of which breaks an entire infection. And when I finally put a name to the family —IranBot, a Mirai fork with a public dossier— it turned out that name had been written on this blog since August: a rival bot had put it there, in the list of competitors it uninstalls on arrival.