• blacklist automation
• blockchain
• botnet detection
• decentralized security
• denylist
• distributed c2
• honeypots
• intrusion prevention
• kex hashes
• kex-filtering
• orb botnets
• proactive defense
• secure blacklist distribution
• ssh fingerprinting
• threat intelligence
• trust model

Kex-Filtering proactively detects SSH botnets by fingerprinting client configurations via KEX hashes, overcoming IP blacklist limits. Tested on Azure/AWS honeypots, it blocked 98.5% of attacks using tens of hashes (<2% false positives). Blacklists are dynamically updated via distributed C2 servers using trust, expiration, and thresholds. Multiple blockchain-based architectures are proposed to ensure secure, tamper-proof, and decentralized blacklist distribution. Analyses are conducted on the implementation feasibility of the method, and performance metrics are explored.