---
title: "Attaque de l’IP : 45.9.20.101 (Amsterdam)"
url: https://www.cyber-neurones.org/2022/05/attaque-de-lip-45-9-20-101-amsterdam/
date: 2022-05-11
modified: 2022-05-11
author: "Frederic"
description: "Voici toutes les tentatives : 45.9.20.101 - - [11/May/2022:09:56:44 +0200] \"POST /Autodiscover/Autodiscover.xml HTTP/1.1\" 302 218 \"-\" \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36\" 45.9.20.101 -..."
categories:
  - "Sécurité"
tags:
  - "iptables"
word_count: 447
---

# Attaque de l’IP : 45.9.20.101 (Amsterdam)

Voici toutes les tentatives :

45.9.20.101 - - [11/May/2022:09:56:44 +0200] "POST /Autodiscover/Autodiscover.xml HTTP/1.1" 302 218 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:09:56:45 +0200] "GET /user/auth/login HTTP/1.1" 200 8190 "http://80.15.48.50:80/Autodiscover/Autodiscover.xml" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:11:09:47 +0200] "GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1" 302 400 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:11:09:48 +0200] "GET /user/auth/login HTTP/1.1" 200 8269 "http://80.15.48.50:80/?XDEBUG_SESSION_START=phpstorm" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:12:05:05 +0200] "GET /console/ HTTP/1.1" 302 400 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:12:05:05 +0200] "GET /user/auth/login HTTP/1.1" 200 8269 "http://80.15.48.50:80/console/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:12:25:06 +0200] "GET / HTTP/1.1" 302 5554 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:12:25:08 +0200] "GET /user/auth/login HTTP/1.1" 200 13468 "https://80.15.48.50:443/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:13:29:32 +0200] "GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1" 302 400 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:13:29:32 +0200] "GET /user/auth/login HTTP/1.1" 200 8272 "http://80.15.48.50:80/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:14:01:19 +0200] "GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1" 302 400 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:14:01:21 +0200] "GET /user/auth/login HTTP/1.1" 200 8269 "http://80.15.48.50:80/?a=fetch&content=die(@md5(HelloThinkCMF))" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:14:38:52 +0200] "GET /actuator/gateway/routes HTTP/1.1" 302 400 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:14:38:52 +0200] "GET /user/auth/login HTTP/1.1" 200 8269 "http://80.15.48.50:80/actuator/gateway/routes" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:15:02:21 +0200] "GET /actuator/gateway/routes HTTP/1.1" 302 5554 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:15:02:24 +0200] "GET /user/auth/login HTTP/1.1" 200 13465 "https://80.15.48.50:443/actuator/gateway/routes" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:16:01:06 +0200] "GET /solr/admin/info/system?wt=json HTTP/1.1" 302 400 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
45.9.20.101 - - [11/May/2022:16:01:06 +0200] "GET /user/auth/login HTTP/1.1" 200 8269 "http://80.15.48.50:80/solr/admin/info/system?wt=json" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

C'est pas la première fois visiblement :

# grep "45.9.20.101" /var/log/apache2/access.humhub.log* | wc -l
65

Un conseil :

iptables -A INPUT -s 45.9.20.101 -j DROP
/usr/sbin/iptables-save > /etc/iptables/rules.v4