---
title: "Nouvelle attaque sur Ngnix : cfg file"
url: https://www.cyber-neurones.org/2021/01/nouvelle-attaque-sur-ngnix-cfg-file/
date: 2021-01-21
modified: 2021-01-21
author: "Frederic"
description: "Voici les logs : # grep \".cfg\" /var/log/apache2/access.humhub.log* | sed 's/:/ /g' | awk '{print $2 \" \" $11}' 216.245.193.22 /provision/prov/000000000000.cfg 216.245.193.22 /polycom/000000000000.cfg 216.245.193.22 /dms/000000000000.cfg 216.245.193.22 /cfg/device.cfg 216.245.193.22 /PP/0000000000000.cfg 216.245.193.22..."
categories:
  - "Sécurité"
tags:
  - "iptables"
word_count: 82
---

# Nouvelle attaque sur Ngnix : cfg file

Voici les logs :
# **grep ".cfg" /var/log/apache2/access.humhub.log* | sed 's/:/ /g' | awk '{print $2 " " $11}'**
216.245.193.22 /provision/prov/000000000000.cfg
216.245.193.22 /polycom/000000000000.cfg
216.245.193.22 /dms/000000000000.cfg
216.245.193.22 /cfg/device.cfg
216.245.193.22 /PP/0000000000000.cfg
216.245.193.22 /p/v2/config/polycom/0000000000000.cfg
216.245.193.22 /polycom/config/0000000000000.cfg
216.245.193.22 /polycom/000000000000.cfg
216.245.193.22 /config/Yealink/y000000000053.cfg
216.245.193.22 /config/Yealink/y000000000044.cfg
216.245.193.22 /ap/yealink/y000000000000.cfg
216.245.193.22 /app/yealink/y000000000000.cfg

# **iptables -A INPUT -s 216.245.193.22 -j DROP**
# **iptables-save > /etc/iptables/rules.v4**
J'ai donc bloqué l'IP : 216.245.193.22 .

## Propriété de l'adresse IP 216.245.193.22

| Localisation | **Inde** |
| ------------ | -------- |
| Réputation | 86 % |
| Anonymat | Aucun détection |
| Usage | Attribué |
| Source | ARIN |
| Nom d'hote | 22-193-245-216.static.reverse.lstn.net |