(Jul 22, 2015 11:47 PM)Odinz Wrote: I actually think that it's less about the traffic volume (even though the networking logic in 99% of the RATs and Botnets is extremely flawed), but rather about the actual port and the encryption key of the packets (if there is any) that cause the actual suspicions in the first place.
I lost 2 DNS's to this myself, both utilizing SSL tunnels. I debated that myself until I realized even encrypted connections were compromised.


