Re: ISP Operators AISURU/Kimwolf botnet

[Benjamin Hatton via NANOG <nanog () lists nanog org>]

As a smaller ISP, I think the biggest thing that would help us would be a
'mainstream' media outlet covering some of it so we have something to show
customers who call in about their internet being bad, us telling them it is
their android streaming box that is taking up their entire connection
moving TBs of data a day, and them responding with "but I bought it from
Walmart/Amazon" or "you are just trying to get me to sign up for your
cable" and refusing to do anything about it because 'free TV'.

Cybersecurity blogs are not on our typical customers reading list.

On Fri, Jan 16, 2026 at 9:03 AM Josh Luthman via NANOG <
nanog () lists nanog org> wrote:

> How?
>
> On Fri, Jan 16, 2026 at 8:34 AM Corey Smith via NANOG <
> nanog () lists nanog org>
> wrote:
>
> > I would appreciate if any ISP Operators could help some of the smaller
> ISP
> > like us in stopping the traffic from these new Malware infected customers
> > that have devices with Aisiura/Kimwolf botnet,
> >
> > These are Residential Proxies for the most part, but hard to stop.
> >
> > Any help would be greatly appreciated.
> > _______________________________________________
> > NANOG mailing list
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/SAWGTYD5FM22MEKO5WIQP2YTSASVV4P7/
> >
> _______________________________________________
> NANOG mailing list
>
> https://lists.nanog.org/archives/list/nanog () lists nanog org/message/ZKPV5KFPLDHSHWJEILE6B472BLMA57EP/
_______________________________________________
NANOG mailing list 
https://lists.nanog.org/archives/list/nanog () lists nanog org/message/OCDKF3WFIVYLZ2QHZROTSHAQINNRZGZD/