Am lasat de curiozitate portul 22 (ssh) deschis sa vad cind mai scaneaza si mai ales cit. Testul l-am facut 3 zile. Lista cu ip-urile unice care au scanat este mai jos:
1.25.202.50
106.3.80.36
111.68.113.44
112.78.5.50
113.240.233.10
113.240.233.2
113.240.248.18
114.112.48.85
116.11.252.194
116.53.130.210
117.103.223.88
117.79.148.41
117.79.91.214
118.244.14.49
122.192.35.240
123.49.33.136
124.122.231.200
125.210.243.249
125.63.72.118
172.17.0.222
177.11.50.250
180.153.224.106
182.71.215.162
186.101.70.194
192.95.6.137
193.136.96.5
193.230.227.28
193.230.227.70
200.38.75.72
202.21.111.140
203.251.30.181
210.76.108.38
211.151.185.54
212.45.46.27
217.172.182.32
218.108.249.44
218.209.161.13
218.24.113.2
218.26.89.179
218.29.228.34
220.191.161.221
222.171.156.100
222.80.184.30
31.184.238.11
58.10.228.147
58.61.160.18
59.53.94.9
61.132.4.85
61.234.104.209
61.236.64.56
62.193.192.214
64.150.180.86
67.23.0.149
69.64.58.102
75.125.130.122
77.232.135.244
85.10.235.37
85.204.238.196
91.121.83.134
91.217.178.194
92.48.122.163
96.8.112.149
Inca nu am facut o mapare geografica a ip-urilor insa sint MULTE care vin din China , din brazilia ( la asta ma asteptam ) , din Rusia si din State.
O sa incerc zilele urmatoare sa adaug si un grafic cu tarile atacatoare. Ca vad ca acuma e la moda cu Red October. Cred ca o sa-mi reiau bunele obiceiuri sa pun honeypots ca vad ca iar e spike de scanuri.
Later update:
Iata ce spuneam :
BD 123.49.33.136
BR 177.11.50.250
CA 192.95.6.137
CN 1.25.202.50
CN 106.3.80.36
CN 113.240.233.10
CN 113.240.233.2
CN 113.240.248.18
CN 114.112.48.85
CN 116.11.252.194
CN 116.53.130.210
CN 117.79.148.41
CN 117.79.91.214
CN 118.244.14.49
CN 122.192.35.240
CN 125.210.243.249
CN 180.153.224.106
CN 210.76.108.38
CN 211.151.185.54
CN 218.108.249.44
CN 218.24.113.2
CN 218.26.89.179
CN 218.29.228.34
CN 220.191.161.221
CN 222.171.156.100
CN 222.80.184.30
CN 58.61.160.18
CN 59.53.94.9
CN 61.132.4.85
CN 61.234.104.209
CN 61.236.64.56
DE 217.172.182.32
DE 85.10.235.37
DE 91.217.178.194
EC 186.101.70.194
FR 62.193.192.214
FR 91.121.83.134
GB 92.48.122.163
ID 111.68.113.44
IN 125.63.72.118
IN 182.71.215.162
KR 203.251.30.181
KR 218.209.161.13
MN 202.21.111.140
MX 200.38.75.72
NL 212.45.46.27
PT 193.136.96.5
RU 31.184.238.11
RU 77.232.135.244
TH 124.122.231.200
TH 58.10.228.147
US 64.150.180.86
US 67.23.0.149
US 69.64.58.102
US 75.125.130.122
US 96.8.112.149
VN 112.78.5.50
VN 117.103.223.88
sall imi dai si mie un scanner bun te rog?
@Catalin – Scanner ? Ce fel de scanner ? Si ce inseamna bun?
cat /var/log/auth.log | grep sshd eventual niste cut la final ….
Comments are closed.