Voici un exemple de trace sur mon serveur :
50.31.21.6 - - [14/Oct/2021:02:02:15 +0200] "GET / HTTP/1.0" 302 5156 "-" "-"
50.31.21.6 - - [14/Oct/2021:02:02:48 +0200] "HEAD / HTTP/1.1" 302 4938 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MDDCJS; rv:11.0) like Gecko"
50.31.21.6 - - [14/Oct/2021:02:02:48 +0200] "GET /nmaplowercheck1634169768 HTTP/1.1" 302 5145 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MDDCJS; rv:11.0) like Gecko"
50.31.21.6 - - [14/Oct/2021:02:02:48 +0200] "POST /sdk HTTP/1.1" 302 4957 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MDDCJS; rv:11.0) like Gecko"
50.31.21.6 - - [14/Oct/2021:02:02:48 +0200] "GET / HTTP/1.0" 302 5156 "-" "-"
50.31.21.6 - - [14/Oct/2021:02:02:49 +0200] "GET /HNAP1 HTTP/1.1" 302 5145 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MDDCJS; rv:11.0) like Gecko"
50.31.21.6 - - [14/Oct/2021:02:02:49 +0200] "GET / HTTP/1.1" 302 5126 "-" "-"
50.31.21.6 - - [14/Oct/2021:02:02:49 +0200] "HEAD /user/auth/login HTTP/1.1" 200 6095 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MDDCJS; rv:11.0) like Gecko"
50.31.21.6 - - [14/Oct/2021:02:02:49 +0200] "GET /evox/about HTTP/1.1" 302 5145 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MDDCJS; rv:11.0) like Gecko"
50.31.21.6 - - [14/Oct/2021:02:02:49 +0200] "GET /user/auth/login HTTP/1.1" 200 29756 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; MDDCJS; rv:11.0) like Gecko"
La signature c’est surtout : « GET /HNAP1 HTTP/1.1 »
Mon action :
# iptables -A INPUT -s 50.31.21.6 -j DROP # /usr/sbin/iptables-save > /etc/iptables/rules.v4
Plus d’information sur l’IP :
| IP Address | Country | Region | City |
|---|---|---|---|
| 50.31.21.6 | United States of America  |
Illinois | Chicago |
| ISP | Organization | Latitude | Longitude |
| SteadFast | Not Available | 41.8761 | -87.6521 |
A noter que c’est visiblement pas la première attaque du type :
134.255.233.173 - - [13/Oct/2021:18:55:13 +0200] "POST /HNAP1/ HTTP/1.1" 302 255 "-" "Mozila/5.0" 192.168.1.153 - - [13/Oct/2021:21:25:40 +0200] "GET /HNAP1/ HTTP/1.1" 302 404 "-" "Avast Antivirus" 112.27.124.140 - - [30/Oct/2020:22:40:00 +0100] "POST /HNAP1/ HTTP/1.0" 408 484 "-" "-" 45.6.195.248 - - [31/Oct/2020:00:23:21 +0100] "POST /HNAP1/ HTTP/1.0" 408 484 "-" "-"
Misère.