How to stop traffic from Mirai botnets?

James, I guess I'd ask why this traffic was allowed through the UTM in the first place instead of letting it be default dropped...

Cheers - Bob

BAlfson Thanks for replying. Not sure how to find that out. Nothing will be logged if it went through, correct? IPS is on. Firewall is on.

You must have a firewall rule that allows port 52555, James.

Cheers - Bob

Thanks Bob. Port 52555 is the sending port that this device is using - it is being received by us on port 80. 

No firewall rules for either (port 80 goes through WAF). 139.130.139.174 is our IP address.

Thanks Bob. Port 52555 is the sending port that this device is using - it is being received by us on port 80. 

No firewall rules for either (port 80 goes through WAF). 139.130.139.174 is our IP address.

I see that now, James.  So it's the hidden, automatic rule created by the configuration daemon.  If you don't want to use Amodin's suggestion, the only other solution is to create a blackhole DNAT for the offending IPs/subnets.  You're right that there's no option to use OTX.  Mirai attacks can come from 100,000 IPs, so I doubt that even OTX would be a solution.  What do you have behind WAF that might be vulnerable to a mirai malware infection?

Cheers - Bob