What is a botnet, and how would we know a device of ours is part of one?
A botnet is a network of infected computers, routers, cameras and other devices that a criminal controls remotely and rents out for spam, credential stuffing, denial-of-service attacks or as a relay for other crimes. Owners rarely notice, because the device keeps working; the cost is your bandwidth, your public address ending up on blocklists, and an attacker with a foothold in your network. Signs are a device contacting a command server at regular intervals, sudden bursts of outbound connections to many addresses, mail sent from a device that should not send mail, or a report from your provider or national CERT. Update internet-connected devices, change their default passwords and block outbound mail except from your mail server. NetSenX flags beaconing and unusual outbound volume per host on every plan, including for devices that cannot run an agent.