Skip to content

Instantly share code, notes, and snippets.

View techhelplist's full-sized avatar

techhelplist

7 followers · 0 following
View GitHub Profile
@techhelplist
techhelplist / rdp-attackers-june2019-d.txt
Last active June 24, 2019 14:50
rdp-attackers-june2019-d.txt
date sourceIP username-attempted
2019-06-17 212.92.104.195 FTPUSER
2019-06-17 212.92.104.195 SQLSERVER
2019-06-17 212.92.104.195 PRODUCTION
2019-06-17 212.92.104.195 BOARDROOM
2019-06-17 212.92.104.195 MARKETING
2019-06-17 212.92.104.195 SHOP
2019-06-17 212.92.104.195 HR
2019-06-17 141.98.83.35 Admin
2019-06-17 212.92.104.195 TECH
@techhelplist
techhelplist / rdp-attackers-july2019-a.txt
Last active July 1, 2019 14:22
rdp-attackers-july2019-a.txt
This file has been truncated, but you can view the full file.
2019-06-26T03:10:53 185.156.177.183 ADMINISTRATOR
2019-06-26T03:11:58 185.156.177.183 ADMINISTRATOR
2019-06-25T22:41:29 185.156.177.215 ADMINISTRATOR
2019-06-26T03:13:06 185.156.177.183 ADMINISTRATOR
2019-06-26T03:13:09 34.74.23.39 01a
2019-06-26T03:21:54 185.156.177.215 ADMINISTRATOR
2019-06-26T03:25:11 185.156.177.183 ADMINISTRATOR
2019-06-25T22:46:07 185.156.177.215 ADMINISTRATOR
2019-06-26T03:37:38 185.156.177.215 ADMINISTRATOR
@techhelplist
techhelplist / vuln-scans-and-attempts-july-2019-a.txt
Created July 1, 2019 15:04
vuln-scans-and-attempts-july-2019-a.txt
Generate Time Source address Threat/Content Name
2019/07/01 00:06:01 36.66.184.24 Drupal Core Remote Code Execution Vulnerability
2019/07/01 00:06:00 36.66.184.24 ThinkPHP Remote Code Execution Vulnerability
2019/07/01 00:05:58 36.66.184.24 ECShop Remote Code Execution Vulnerability
2019/07/01 00:05:57 36.66.184.24 Joomla HTTP User Agent Object Injection Vulnerability
2019/07/01 00:03:43 36.66.184.24 ThinkPHP Remote Code Execution Vulnerability
2019/06/30 18:51:21 119.23.63.102 Spring Data Commons Remote Code Execution Vulnerability
2019/06/30 18:46:27 129.213.113.82 Spring Data Commons Remote Code Execution Vulnerability
2019/06/30 12:55:51 178.156.202.76 ECShop Remote Code Execution Vulnerability
2019/06/30 12:55:47 178.156.202.76 PHP Code Injection Vulnerability
@techhelplist
techhelplist / rdp-attackers-july2019-b.txt
Created July 8, 2019 14:24
rdp-attackers-july2019-b.txt
This file has been truncated, but you can view the full file.
2019-07-03T14:26:05.616Z 62.210.188.32 ADMINISTRADOR
2019-07-03T14:27:10.726Z 74.208.77.35 ADMINISTRATOR
2019-07-03T14:25:58.667Z 51.77.106.244 ADMINISTRATOR
2019-07-03T14:34:33.495Z 51.254.14.52 USER
2019-07-03T14:30:32.691Z 51.254.14.52 USER3
2019-07-03T14:25:07.186Z 51.254.14.52 USERNAME
2019-07-03T14:32:23.645Z 51.254.14.52 SCANNER
2019-07-03T17:48:57.135Z 185.156.177.180 admin
2019-07-03T17:50:01.943Z 185.156.177.180 admin
2019-07-03T14:37:21.786Z 74.208.77.35 ADMINISTRATOR
@techhelplist
techhelplist / vuln-scans-and-attempts-july-2019-b.txt
Created July 8, 2019 16:41
vuln-scans-and-attempts-july-2019-b.txt
Generate Time Source address Threat/Content Name
2019/07/08 10:22:30 90.65.150.4 LinkSys E-series Routers Remote Code Execution Vulnerability
2019/07/08 09:41:13 188.27.193.175 LinkSys E-series Routers Remote Code Execution Vulnerability
2019/07/08 06:29:20 36.91.129.186 ECShop Remote Code Execution Vulnerability
2019/07/08 06:29:15 36.91.129.186 Joomla HTTP User Agent Object Injection Vulnerability
2019/07/08 06:27:14 36.91.129.186 Joomla HTTP User Agent Object Injection Vulnerability
2019/07/08 06:25:12 36.91.129.186 Drupal Core Remote Code Execution Vulnerability
2019/07/08 06:25:04 36.91.129.186 ThinkPHP Remote Code Execution Vulnerability
2019/07/08 05:45:38 118.118.152.23 LinkSys E-series Routers Remote Code Execution Vulnerability
@techhelplist
techhelplist / rdp-attackers-july2019-c.txt
Created July 15, 2019 15:13
rdp-attackers-july2019-c.txt
This file has been truncated, but you can view the full file.
timestamp winlogbeat_event_data_IpAddress winlogbeat_event_data_TargetUserName
2019-07-12T02:31:37.887Z 116.50.233.174 ADMINISTRATOR
2019-07-12T04:00:50.166Z 203.206.163.19 Hr
2019-07-12T02:31:26.443Z 203.162.13.102 ADMINISTRATOR
2019-07-12T04:00:56.592Z 212.92.106.146 TESTE1
2019-07-12T02:43:52.839Z 51.75.160.79 BACKUP
2019-07-12T17:26:49.832Z 51.75.160.79 ADMINISTRATOR1
2019-07-12T17:26:38.203Z 212.92.122.16 DOCTORS
2019-07-12T17:26:42.302Z 51.75.160.79 ADM
2019-07-12T02:44:00.909Z 51.75.160.79 ITADMIN
@techhelplist
techhelplist / vuln-scans-and-attempts-july-2019-c.txt
Created July 15, 2019 17:33
vuln-scans-and-attempts-july-2019-c.txt
Generate Time Source address Threat/Content Name
2019/07/15 10:40:30 47.186.67.61 LinkSys E-series Routers Remote Code Execution Vulnerability
2019/07/15 10:21:27 209.45.53.225 LinkSys E-series Routers Remote Code Execution Vulnerability
2019/07/15 09:42:10 117.60.141.219 LinkSys E-series Routers Remote Code Execution Vulnerability
2019/07/15 08:17:46 106.111.179.82 LinkSys E-series Routers Remote Code Execution Vulnerability
2019/07/15 08:03:27 188.32.226.166 LinkSys E-series Routers Remote Code Execution Vulnerability
2019/07/15 08:00:49 180.126.235.123 LinkSys E-series Routers Remote Code Execution Vulnerability
2019/07/15 07:36:36 117.34.74.38 Spring Data Commons Remote Code Execution Vulnerability
2019/07/15 05:42:26 129.28.29.30 ECShop Remote Code Execution Vulnerability
2019/07/15 05:42:22 129.28.29.30 Joomla HTTP User Agent Object Injection Vulnerability
@techhelplist
techhelplist / rdp-attackers-july2019-d.txt
Created July 22, 2019 06:16
rdp-attackers-july2019-d.txt
This file has been truncated, but you can view the full file.
timestamp winlogbeat_event_data_IpAddress winlogbeat_event_data_TargetUserName
2019-07-15T15:49:38.485Z 104.238.214.243 ADMINISTRATOR
2019-07-20T21:52:46.838Z 81.5.72.198 ADMIN
2019-07-20T21:52:53.741Z 185.232.21.28 WEBUSER
2019-07-20T21:54:03.512Z 185.232.21.28 MAILROOM
2019-07-20T21:47:15.249Z 103.77.107.166 admin
2019-07-20T21:47:15.565Z 103.77.107.166 admin
2019-07-20T21:47:15.719Z 103.77.107.166 admin
2019-07-20T21:47:19.447Z 185.232.21.28 STEVE
2019-07-20T21:47:17.808Z 83.240.199.229 ADMINISTRATOR
@techhelplist
techhelplist / vuln-scans-and-attempts-july-2019-d.txt
Created July 23, 2019 15:07
vuln-scans-and-attempts-july-2019-d.txt
Generate Time Source address Threat/Content Name
2019/07/23 08:19:03 104.148.87.123 ECShop Remote Code Execution Vulnerability(54648)
2019/07/23 08:18:59 104.148.87.123 PHP Code Injection Vulnerability(55901)
2019/07/23 08:18:54 104.148.87.123 Smallshell ASP Webshell Upload Detection(18260)
2019/07/23 08:18:54 104.148.87.123 Smallshell ASP Webshell Upload Detection(18260)
2019/07/23 07:25:28 104.148.105.3 PHP Code Injection Vulnerability(55901)
2019/07/23 07:25:24 104.148.105.3 ECShop Remote Code Execution Vulnerability(54648)
2019/07/23 07:25:22 104.148.105.3 Smallshell ASP Webshell Upload Detection(18260)
2019/07/23 07:25:22 104.148.105.3 Smallshell ASP Webshell Upload Detection(18260)
2019/07/23 07:12:05 83.1.215.4 LinkSys E-series Routers Remote Code Execution Vulnerability(36358)
@techhelplist
techhelplist / rdp-attackers-july2019-e.txt
Created July 29, 2019 14:09
rdp-attackers-july2019-e.txt
This file has been truncated, but you can view the full file.
timestamp winlogbeat_event_data_IpAddress winlogbeat_event_data_TargetUserName
2019-07-23T16:23:10.758Z 185.156.177.219 TARYN
2019-07-23T16:14:49.627Z 193.109.135.145 admin
2019-07-23T16:14:49.992Z 193.109.135.145 admin
2019-07-23T16:14:48.560Z 185.156.177.219 CLOE
2019-07-23T16:41:01.240Z 193.188.22.183 SCAN
2019-07-23T16:52:00.200Z 213.124.32.219 ADMINISTRATOR
2019-07-23T16:21:43.151Z 202.57.46.220 admin
2019-07-23T16:21:43.277Z 202.57.46.220 admin
2019-07-23T16:21:43.152Z 202.57.46.220 admin