---
title: "Vulnabilitée elrekt.php afin de lister les IPs qui font des scans"
url: https://www.cyber-neurones.org/2020/12/vulnabilitee-elrekt-php-afin-de-lister-les-ips-qui-font-des-scans/
date: 2020-12-01
modified: 2020-12-01
author: "Frederic"
description: "La commande pour avoir les IP : zgrep \"elrekt.php\" /var/log/apache2/error* | awk '{print $10}' | sed 's/:/ /g' | awk '{print $1}' | sort | uniq -c 1 112.126.90.41 1..."
categories:
  - "Sécurité"
tags:
  - "attack"
  - "scan"
word_count: 190
---

# Vulnabilitée elrekt.php afin de lister les IPs qui font des scans

La commande pour avoir les IP :
**zgrep "elrekt.php" /var/log/apache2/error* | awk '{print $10}' | sed 's/:/ /g' | awk '{print $1}' | sort | uniq -c**
1 112.126.90.41
1 116.147.2.110
1 122.14.209.13
1 158.69.13.199
1 193.112.88.67
1 210.21.218.26
1 223.75.249.2
1 27.50.160.35
1 49.233.63.234
1 91.242.37.16

Ensuite un petit blocage :
iptables -A INPUT -s 112.126.90.41 -j DROP
-> **China** Hangzhou Aliyun Computing Co. Ltd
iptables -A INPUT -s 116.147.2.110 -j DROP
-> **China** Nanjing China Unicom
iptables -A INPUT -s 122.14.209.13 -j DROP
-> **China** Beijing Beijing Teamsun Technology Co.ltd.
iptables -A INPUT -s 158.69.13.199 -j DROP
-> **Canada** Montreal Portalpbx Eirl
iptables -A INPUT -s 193.112.88.67 -j DROP
-> **China** Beijing Tencent Cloud Computing (beijing) Co. Ltd
iptables -A INPUT -s 210.21.218.26 -j DROP
-> **China** Shenzhen Shenzhen Branch China Netcom Corp
iptables -A INPUT -s 223.75.249.2 -j DROP
-> **China** Xiangyang China Mobile Communications Corporation
iptables -A INPUT -s 27.50.160.35 -j DRO
-> **China** Zhengzhou Henan Xinfeijinxin Computer Co. Ltd
iptables -A INPUT -s 49.233.63.234 -j DROP
-> **China** Beijing Tencent Cloud Computing (beijing) Co. Ltd.
iptables -A INPUT -s 91.242.37.16 -j DROP
-> **RUSSIAN** FEDERATION