---
title: "Nouvelle attaque sur Ngnix : /owa/auth/logon.aspx?url=https://1/ecp/"
url: https://www.cyber-neurones.org/2021/01/nouvelle-attaque-sur-ngnix-owa-auth-logon-aspxurlhttps-1-ecp/
date: 2021-01-21
modified: 2021-01-21
lang: fr
author: "Frederic"
description: "Voici les logs : # grep \"/owa/auth/logon.aspx\" /var/log/apache2/access.humhub.log* 192.241.224.104 - - [21/Jan/2021:03:47:56 +0100] \"GET /owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f HTTP/1.1\" 404 3436 \"-\" \"Mozilla/5.0 zgrab/0.x\" 192.241.206.242 - - [20/Jan/2021:03:14:29 +0100] \"GET /owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f HTTP/1.1\" 404..."
categories:
  - "Sécurité"
tags:
  - "iptables"
word_count: 101
---

# Nouvelle attaque sur Ngnix : /owa/auth/logon.aspx?url=https://1/ecp/

Voici les logs :
#** grep "/owa/auth/logon.aspx" /var/log/apache2/access.humhub.log***
192.241.224.104 - - [21/Jan/2021:03:47:56 +0100] "GET /owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f HTTP/1.1" 404 3436 "-" "Mozilla/5.0 zgrab/0.x"
192.241.206.242 - - [20/Jan/2021:03:14:29 +0100] "GET /owa/auth/logon.aspx?url=https%3a%2f%2f1%2fecp%2f HTTP/1.1" 404 3534 "-" "Mozilla/5.0 zgrab/0.x"

Je vais donc bloquer les IP :
# iptables -A INPUT -s 192.241.224.104 -j DROP
# iptables -A INPUT -s 192.241.206.242 -j DROP
# iptables-save > /etc/iptables/rules.v4

## Propriété de l'adresse IP 192.241.206.242

| Localisation | États-Unis |
| ------------ | ----------- |
| Réputation | 100 % |
| Anonymat | Aucun détection |
| Usage | Attribué |
| Source | ARIN |
| Nom d'hote | zg-1218a-142.stretchoid.com |

## Propriété de l'adresse IP 192.241.224.104

| Localisation | États-Unis |
| ------------ | ----------- |
| Réputation | 86 % |
| Anonymat | Aucun détection |
| Usage | Attribué |
| Source | ARIN |
| Nom d'hote | zg-1218c-277.stretchoid.com |