Skip to content

Instantly share code, notes, and snippets.

View techhelplist's full-sized avatar

techhelplist

7 followers · 0 following
View GitHub Profile
@techhelplist
techhelplist / vuln-scans-and-attempts-july-2019-e.txt
Created July 29, 2019 15:56
vuln-scans-and-attempts-july-2019-e.txt
Generate Time Source address Threat/Content Name
2019/07/28 22:56:18 58.153.107.86 Netgear DGN Device Remote Command Execution Vulnerability(40741)
2019/07/28 19:38:03 45.67.14.50 LinkSys E-series Routers Remote Code Execution Vulnerability(36358)
2019/07/28 19:09:24 154.80.229.35 Drupal Core Remote Code Execution Vulnerability(40627)
2019/07/28 19:09:20 154.80.229.35 ECShop Remote Code Execution Vulnerability(54648)
2019/07/28 19:09:20 154.80.229.35 Joomla HTTP User Agent Object Injection Vulnerability(38519)
2019/07/28 19:08:43 154.80.229.35 ThinkPHP Remote Code Execution Vulnerability(55367)
2019/07/28 19:08:43 154.80.229.35 ThinkPHP Remote Code Execution Vulnerability(55367)
2019/07/28 18:57:16 124.232.163.42 ECShop Remote Code Execution Vulnerability(54648)
2019/07/28 17:10:42 211.193.211.96 LinkSys E-series Routers Remote Code Execution Vulnerability(36358)
@techhelplist
techhelplist / rdp-attackers-august2019-a.txt
Created August 5, 2019 14:43
rdp-attackers-august2019-a.txt
This file has been truncated, but you can view the full file.
timestamp winlogbeat_event_data_IpAddress winlogbeat_event_data_TargetUserName
2019-07-30T07:36:44.499Z 71.33.30.145 STAFF
2019-07-30T15:11:03.899Z 195.9.95.107 ADMINISTRATOR
2019-07-30T19:37:04.316Z 185.230.127.229 CCOLEMAN
2019-07-30T07:37:12.935Z 71.33.30.145 STAFF
2019-07-30T14:45:27.750Z 185.230.127.229 ATLAS
2019-07-30T07:37:32.776Z 185.156.177.219 DORCAS
2019-07-30T07:37:40.044Z 98.159.216.230 CBS
2019-07-30T19:37:34.869Z 185.230.127.229 PROD
@techhelplist
techhelplist / imap-attackers-august2019-a.txt
Created August 5, 2019 15:05
imap-attackers-august2019-a.txt
timestamp imap_attacker_ip imaphoney_credentials_attempted
2019-07-30T09:30:38.000Z 195.9.138.78 "administrator@redacted password123"
2019-07-30T07:22:19.000Z 182.190.4.53 "sales@redacted password"
2019-07-30T06:39:15.000Z 119.204.177.120 "sales@redacted password"
2019-07-30T09:05:38.000Z 27.211.168.35 "administrator@redacted password123"
2019-07-31T19:16:35.000Z 62.48.247.238 "admin@redacted Password123"
2019-07-31T19:54:25.000Z 218.84.117.90 "admin@redacted Password123"
2019-07-31T20:14:24.000Z 60.12.84.190 "info@redacted Password"
2019-07-31T09:12:20.000Z 218.211.96.204 "info@redacted Password123"
2019-07-29T15:07:53.000Z 178.124.166.216 "info@redacted password123"
@techhelplist
techhelplist / vuln-scans-and-attempts-august-2019-a.txt
Created August 5, 2019 16:20
vuln-scans-and-attempts-august-2019-a.txt
Generate Time Source address Threat/Content Name
2019/08/05 10:03:32 118.190.102.229 Spring Data Commons Remote Code Execution Vulnerability
2019/08/05 09:30:48 176.122.128.92 Spring Data Commons Remote Code Execution Vulnerability
2019/08/05 05:52:00 173.164.6.101 LinkSys E-series Routers Remote Code Execution Vulnerability
2019/08/05 05:29:14 23.228.90.12 PHP Code Injection Vulnerability
2019/08/05 05:29:12 23.228.90.12 ECShop Remote Code Execution Vulnerability
2019/08/05 05:14:18 103.82.235.10 PHP Code Injection Vulnerability
2019/08/05 05:14:16 103.82.235.10 ECShop Remote Code Execution Vulnerability
2019/08/05 04:01:03 188.138.205.243 Drupal Core Remote Code Execution Vulnerability
2019/08/05 04:01:02 188.138.205.243 ThinkPHP Remote Code Execution Vulnerability
@techhelplist
techhelplist / rdp-attackers-august2019-b.txt
Created August 12, 2019 15:02
rdp-attackers-august2019-b.txt
This file has been truncated, but you can view the full file.
timestamp winlogbeat_event_data_IpAddress winlogbeat_event_data_TargetUserName
2019-08-07T18:05Z 66.181.165.166 ADMINISTRATOR
2019-08-07T18:05Z 66.240.205.40 ADMINISTRATOR
2019-08-07T18:05Z 52.177.200.175 ADMINISTRATOR
2019-08-07T18:05Z 5.188.112.78 admin
2019-08-07T18:06Z 66.240.205.40 ADMINISTRATOR
2019-08-07T18:05Z 119.28.140.160 ADMIN
2019-08-07T18:07Z 66.240.205.40 ADMINISTRATOR
@techhelplist
techhelplist / vuln-scans-and-attempts-august-2019-b.txt
Created August 12, 2019 16:43
vuln-scans-and-attempts-august-2019-b.txt
Generate Time Source address Threat/Content Name
2019/08/12 08:32:31 104.148.105.4 PHP Code Injection Vulnerability
2019/08/12 08:32:26 104.148.105.4 ECShop Remote Code Execution Vulnerability
2019/08/12 00:45:53 94.191.92.102 Drupal Core Remote Code Execution Vulnerability
2019/08/12 00:45:51 94.191.92.102 ThinkPHP Remote Code Execution Vulnerability
2019/08/12 00:45:49 94.191.92.102 ECShop Remote Code Execution Vulnerability
2019/08/12 00:45:49 94.191.92.102 Joomla HTTP User Agent Object Injection Vulnerability
2019/08/12 00:44:22 94.191.92.102 ThinkPHP Remote Code Execution Vulnerability
2019/08/12 00:44:22 94.191.92.102 ThinkPHP Remote Code Execution Vulnerability
2019/08/12 00:02:23 219.145.144.65 WordPress Login Brute Force Attempt
@techhelplist
techhelplist / imap-attackers-august2019-b.txt
Last active August 19, 2019 15:59
imap-attackers-august2019-b.txt
timestamp imap_attacker_ip
2019-08-07T21:07:36.000Z 171.221.226.23
2019-08-07T21:17:52.000Z 61.150.76.201
2019-08-07T21:57:43.000Z 85.172.104.55
2019-08-07T21:24:55.000Z 59.49.233.24
2019-08-09T03:54:38.000Z 120.203.25.58
2019-08-05T17:33:17.000Z 94.156.119.230
2019-08-06T08:51:10.000Z 91.234.226.162
2019-08-06T15:14:18.000Z 194.158.212.21
2019-08-06T12:12:25.000Z 59.44.47.106
@techhelplist
techhelplist / rdp-attackers-august2019-c.txt
Created August 19, 2019 16:04
rdp-attackers-august2019-c.txt
This file has been truncated, but you can view the full file.
#honeypot 1
timestamp winlogbeat_event_data_IpAddress winlogbeat_event_data_TargetUserName
2019-08-15T21:27:33.556Z 155.93.255.146 DAISY
2019-08-15T22:13:53.110Z 185.230.127.234 FRONT
2019-08-15T18:45:49.867Z 190.12.76.82 ADMINISTRATÖR
2019-08-12T17:20:58.938Z 3.83.133.109 ADMINISTRATOR
2019-08-15T18:46:24.250Z 185.230.127.234 SAGE
2019-08-15T21:31:10.172Z 182.253.0.2 ADMINISTRATOR
2019-08-15T21:31:11.881Z 185.230.127.234 MARKETING
@techhelplist
techhelplist / imap-attackers-august2019-c.txt
Created August 19, 2019 17:21
imap-attackers-august2019-c.txt
timestamp imap_attacker_ip
2019-08-15T21:34:12.000Z 61.134.44.28
2019-08-16T03:03:24.000Z 65.169.38.111
2019-08-15T19:02:41.000Z 220.162.158.2
2019-08-16T02:56:45.000Z 179.42.210.99
2019-08-16T03:28:18.000Z 137.59.44.66
2019-08-15T21:51:05.000Z 58.242.164.10
2019-08-15T22:38:58.000Z 96.44.184.6
2019-08-15T23:16:27.000Z 61.134.36.115
2019-08-15T23:22:13.000Z 103.21.207.3
@techhelplist
techhelplist / vuln-scans-and-attempts-august-2019-c.txt
Created August 19, 2019 17:37
vuln-scans-and-attempts-august-2019-c.txt
Generate Time Source address Threat/Content Name
2019/08/19 05:51:31 62.234.100.184 ECShop Remote Code Execution Vulnerability
2019/08/19 05:51:30 62.234.100.184 Drupal Core Remote Code Execution Vulnerability
2019/08/19 05:51:30 62.234.100.184 Joomla HTTP User Agent Object Injection Vulnerability
2019/08/19 05:51:30 62.234.100.184 Joomla HTTP User Agent Object Injection Vulnerability
2019/08/19 05:51:29 62.234.100.184 Joomla HTTP User Agent Object Injection Vulnerability
2019/08/19 05:51:27 62.234.100.184 ThinkPHP Remote Code Execution Vulnerability
2019/08/19 05:50:12 62.234.100.184 ThinkPHP Remote Code Execution Vulnerability
2019/08/19 05:50:11 62.234.100.184 ThinkPHP Remote Code Execution Vulnerability
2019/08/19 04:32:37 129.28.68.148 ECShop Remote Code Execution Vulnerability