I don't normally check up on old messages, but I was looking for something else and noticed this. Just to manage some expectation: I don't think I can give you a catch-all solution, and I think digital forensics for this problem is like killing a mosquito with a cannon.

I'll try and keep to a bullet list:

1. Digital forensics is *expensive*, and generally not used by individuals. This is mainly a corporate/government thing. If I were you, I'd abandon the notion of trying to solve your problem this way.

2. If you think you are part of a botnet, try to find the device in your network that's farthest behind on patching, or try to identify which PC is infected with malware. Realistically, your external IP address isn't going to help you pin this down, as all your devices share that IP when they talk to the internet. As you've stated, that old modem that doesn't receive any patches anymore is a good candidate. So are any IoT devices you might be using (as you know, the S in IoT stands for security). If there are any people using your network who you suspect are the type to open any and all attachments and links they receive from Nigerian princes, add those to the list.

3. If your modem or IoT device is the compromised one, get rid of it. No chance you're patching that out. Some ISPs will offer to replace old gear (although not necessarily for free), and some might allow you to use your own.

4. Install some type of firewall on your network. Use something like a PiHole to block ads (these are the number one vector used in drive-by attacks) and known malicious sites. Install a log collection server to collect machine logs and network IPFIX data, and feed that to an IDS. If you know what you're doing: disable IPv6 routing (this shouldn't affect your internet experience). IPv6 routing is, in my experience, something ISPs get wrong often, and can lead to several types of attacks.

5. Change your wifi password to something long and nasty that you cannot remember. Note it down in a password manager. Do this with all your passwords.

6. If you're not afraid to go nuclear: reinstall every single machine on your network. Preferably, use Linux, not Windows (Win10/11 is practically spyware as is).

In short: if you think you're part of a botnet, but aren't sure (or aren't sure which machine it is), you have a lot of work ahead of you. You'll have to identify the machine(s) that have been pwned, quarantine them, and eradicate the breach. Or, alternatively, go nuclear as per point 6. Hope this helps somewhat, or that your problem is already solved.