API tools faq
paste
techhelplist

some blocked attacks and scans

techhelplist
Apr 11th, 2015
610
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 6.53 KB | None | 0 0
raw download clone embed print report
  1. ### NGFW - Next Ghettoration Fire Wall - IPs to block from Onion Alerts ###
  2. ### Onion report generated at 2015-04-11 17:43:21 +0000
  3. # onion-serial-number=1428774201
  4. # Number of rules in effect: 23
  5. # ET WEB_SERVER%
  6. # ET CURRENT_EVENTS DNS Amplification%
  7. # ET SCAN ZmEu%
  8. # ET CURRENT_EVENTS Malformed HeartBeat%
  9. # ET CURRENT_EVENTS TLS HeartBeat%
  10. # ET CURRENT_EVENTS Possible OpenSSL HeartBleed%
  11. # ET CURRENT_EVENTS Possible TLS HeartBleed%
  12. # ET CURRENT_EVENTS Possible ZyXELs ZynOS%
  13. # ET SCAN Tomcat%
  14. # ET SCAN Paros%
  15. # ET COMPROMISED Known Compromised%
  16. # ET WEB_SPECIFIC_APPS WBBlog SQL Injection%
  17. # ET WEB_SPECIFIC_APPS Possible WP CuckooTap%
  18. # ET CURRENT_EVENTS Joomla Component%
  19. # ET WEB_SPECIFIC_APPS iWare Professional%
  20. # ET SCAN Core-Project%
  21. # ET MALWARE Fake Mozilla User-Agent%
  22. # ET MALWARE Mozilla User-Agent%Inbound Likely Fake
  23. # GPL DNS named version attempt
  24. # ET WEB_SERVER Muieblackcat
  25. # ET SCAN NETWORK Incoming%
  26. # ET TROJAN Palevo%
  27. # ET DOS Possible NTP DDoS%
  28. 193.111.139.225/32 # ET WEB_SERVER ColdFusion administrator access
  29. 23.95.248.102/32 # ET WEB_SERVER DFind w00tw00t GET-Requests
  30. 222.73.18.162/32 # ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers
  31. 222.73.18.162/32 # ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer
  32. 61.138.252.235/32 # ET WEB_SERVER DFind w00tw00t GET-Requests
  33. 23.95.12.210/32 # ET WEB_SERVER Muieblackcat scanner
  34. 64.251.193.15/32 # ET WEB_SERVER ColdFusion administrator access
  35. 66.165.183.94/32 # ET WEB_SERVER ColdFusion administrator access
  36. 104.255.68.139/32 # ET WEB_SERVER Muieblackcat scanner
  37. 118.98.104.21/32 # ET WEB_SERVER PHP Attack Tool Morfeus F Scanner
  38. 95.211.148.8/32 # ET WEB_SERVER DFind w00tw00t GET-Requests
  39. 122.226.102.46/32 # ET WEB_SERVER Possible Apache Struts OGNL Command Execution CVE-2013-2251 redirect
  40. 46.4.73.171/32 # ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP Cookie
  41. 46.4.73.171/32 # ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers
  42. 46.4.73.171/32 # ET WEB_SERVER Possible bash shell piped to dev udp Inbound to WebServer
  43. 46.4.73.171/32 # ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer
  44. 46.28.206.148/32 # ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers
  45. 46.28.206.148/32 # ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer
  46. 222.186.58.175/32 # ET WEB_SERVER Possible Apache Struts OGNL Command Execution CVE-2013-2251 redirect
  47. 208.109.86.203/32 # ET WEB_SERVER CURL Command Specifying Output in HTTP Headers
  48. 208.109.86.203/32 # ET WEB_SERVER WGET Command Specifying Output in HTTP Headers
  49. 208.109.86.203/32 # ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers
  50. 208.109.86.203/32 # ET WEB_SERVER Access to /phppath/php Possible Plesk 0-day Exploit June 05 2013
  51. 217.243.172.154/32 # ET WEB_SERVER WGET Command Specifying Output in HTTP Headers
  52. 217.243.172.154/32 # ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers
  53. 217.243.172.154/32 # ET WEB_SERVER CURL Command Specifying Output in HTTP Headers
  54. 88.149.202.139/32 # ET WEB_SERVER WGET Command Specifying Output in HTTP Headers
  55. 88.149.202.139/32 # ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers
  56. 88.149.202.139/32 # ET WEB_SERVER CURL Command Specifying Output in HTTP Headers
  57. 202.195.160.11/32 # ET WEB_SERVER WGET Command Specifying Output in HTTP Headers
  58. 202.195.160.11/32 # ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers
  59. 202.195.160.11/32 # ET WEB_SERVER CURL Command Specifying Output in HTTP Headers
  60. 186.202.17.203/32 # ET WEB_SERVER WGET Command Specifying Output in HTTP Headers
  61. 186.202.17.203/32 # ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers
  62. 186.202.17.203/32 # ET WEB_SERVER CURL Command Specifying Output in HTTP Headers
  63. 186.202.17.203/32 # ET WEB_SERVER Access to /phppath/php Possible Plesk 0-day Exploit June 05 2013
  64. 66.228.114.210/32 # ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers
  65. 66.228.114.210/32 # ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP Cookie
  66. 180.250.195.30/32 # ET WEB_SERVER CURL Command Specifying Output in HTTP Headers
  67. 180.250.195.30/32 # ET WEB_SERVER Possible CVE-2014-6271 Attempt in Headers
  68. 180.250.195.30/32 # ET WEB_SERVER WGET Command Specifying Output in HTTP Headers
  69. 180.250.195.30/32 # ET WEB_SERVER Access to /phppath/php Possible Plesk 0-day Exploit June 05 2013
  70. 104.243.47.26/32 # ET WEB_SERVER Muieblackcat scanner
  71. 54.158.192.194/32 # ET WEB_SERVER auto_prepend_file PHP config option in uri
  72. 54.158.192.194/32 # ET WEB_SERVER suhosin.simulation PHP config option in uri
  73. 54.158.192.194/32 # ET WEB_SERVER PHP tags in HTTP POST
  74. 54.158.192.194/32 # ET WEB_SERVER open_basedir PHP config option in uri
  75. 54.158.192.194/32 # ET WEB_SERVER allow_url_include PHP config option in uri
  76. 54.158.192.194/32 # ET WEB_SERVER safe_mode PHP config option in uri
  77. 54.158.192.194/32 # ET WEB_SERVER disable_functions PHP config option in uri
  78. 23.95.248.102/32 # ET SCAN ZmEu Scanner User-Agent Inbound
  79. 61.138.252.235/32 # ET SCAN ZmEu Scanner User-Agent Inbound
  80. 91.217.90.49/32 # ET CURRENT_EVENTS Possible ZyXELs ZynOS Configuration Download Attempt (Contains Passwords)
  81. 91.197.131.15/32 # ET COMPROMISED Known Compromised or Hostile Host Traffic group 36
  82. 122.226.102.46/32 # ET MALWARE Mozilla User-Agent (Mozilla/5.0) Inbound Likely Fake
  83. 222.186.58.175/32 # ET MALWARE Mozilla User-Agent (Mozilla/5.0) Inbound Likely Fake
  84. 124.232.142.220/32 # GPL DNS named version attempt
  85. 149.20.59.239/32 # GPL DNS named version attempt
  86. 118.192.48.40/32 # GPL DNS named version attempt
  87. 125.97.246.7/32 # GPL DNS named version attempt
  88. 149.20.59.134/32 # GPL DNS named version attempt
  89. 71.6.216.41/32 # GPL DNS named version attempt
  90. 71.6.216.40/32 # GPL DNS named version attempt
  91. 71.6.216.46/32 # GPL DNS named version attempt
  92. 188.138.9.50/32 # GPL DNS named version attempt
  93. 149.20.59.215/32 # GPL DNS named version attempt
  94. 195.208.26.77/32 # GPL DNS named version attempt
  95. 71.6.216.55/32 # GPL DNS named version attempt
  96. 71.6.216.54/32 # GPL DNS named version attempt
  97. 71.6.216.60/32 # GPL DNS named version attempt
  98. 82.221.105.7/32 # GPL DNS named version attempt
  99. 149.20.59.131/32 # GPL DNS named version attempt
  100. 71.6.216.38/32 # GPL DNS named version attempt
  101. 71.6.216.61/32 # GPL DNS named version attempt
  102. 198.20.70.114/32 # GPL DNS named version attempt
  103. 61.240.144.66/32 # ET SCAN NETWORK Incoming Masscan detected
  104. 61.240.144.65/32 # ET SCAN NETWORK Incoming Masscan detected
  105. 61.240.144.67/32 # ET SCAN NETWORK Incoming Masscan detected
  106. 78.39.133.2/32 # ET SCAN NETWORK Incoming Masscan detected
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!