Несколько сайтов в моем администрировании подверглись брутфорс-атаке в начале мая. Анализ логов только на одном из сайтов показал, что злоумышленником проводилась атака с серверов известных компаний, таких как Microsoft, Amazon, Google, к которым, вероятно, давно  получен несанкционированный доступ. Мои коллеги обращались в abuse-центр Микрософт, однако сотрудники известной компании не отреагировали на сообщение. Как и обещал, выкладываю список скомпрометированных IP-адресов для желающих пополнить свои черные списки и фильтры. Как видно из скриншота выше, AbuseIPDB уже не реагирует на жалобы.

В первую очередь список IP, с которых было более 1000 запросов:

74.208.128.88 1&1 IONOS Inc (20021 запрос к админке)
104.42.116.229 Microsoft (3075 запросов)
52.138.3.22 Microsoft (2072 запроса)
40.76.6.32 Microsoft (1979 запросов)
52.170.116.159 Microsoft (1963 запроса)
134.209.98.100 DIGITALOCEAN (1007 запросов)
52.221.211.14 Amazon (1005 запросов)

Список IP,  не дотянувших по запросам до 1000:

163.172.110.152
195.154.107.128
137.117.80.211
118.89.31.212
218.21.32.98
73.36.232.192
116.114.84.122
14.161.43.54
82.194.18.135
41.139.227.145
220.164.2.67
221.199.43.146
208.53.45.68
94.20.65.14
193.77.81.3
202.171.77.14
62.210.177.42
218.93.11.82
123.24.205.79
39.155.215.202
221.226.1.210
178.46.160.24
183.219.101.110
202.43.168.81
137.117.80.211
171.103.78.130
45.32.124.245
117.103.84.102
183.234.36.42
190.223.60.139
190.223.60.139
108.170.108.155
51.79.111.220
5.141.86.107

Список IP, стучавшихся в админку, количество обращений которых я не считал:

183.89.215.76
66.110.216.198
184.185.2.49
203.147.69.131
95.179.127.56
78.26.143.31
184.185.236.87
79.162.246.56
39.155.215.202
117.6.213.40
119.1.210.139
13.232.45.103
103.147.10.222
104.237.147.13
80.82.68.229
192.241.213.147
62.210.177.41
169.54.150.146
149.202.77.151
66.110.216.209
136.228.161.27
113.161.57.213
212.92.105.227
147.135.170.161
23.83.130.136

165.22.240.63
81.170.239.2
178.32.200.22
34.106.76.198
178.32.200.22
142.93.35.169
217.199.161.244
139.59.27.226
209.97.179.52
3.6.62.202
185.86.164.101
192.185.219.16
178.32.200.22
138.197.166.251
142.93.182.7
195.123.209.35
47.100.197.136
185.74.81.24
178.128.114.38
35.198.49.134
128.199.254.23
37.187.134.111
157.245.96.139
54.37.21.211
195.123.209.35
178.62.66.49
185.86.164.109
165.227.15.124
104.248.18.21
146.185.142.200
142.93.124.56
61.220.55.240
51.77.223.62
185.85.238.244
116.62.49.96
165.227.15.124
47.101.193.3
166.62.100.99
159.89.2.220
154.0.174.73
69.163.238.207
61.12.92.146
3.17.160.139
167.172.77.153
144.217.70.190
208.109.53.185
167.71.67.66
103.129.223.126
37.59.98.179
34.87.64.132
149.202.70.189
192.169.180.44
62.221.209.62
87.98.250.212
151.80.70.176
185.74.81.24
138.197.166.251
188.166.18.69
151.80.70.176
47.89.179.29
167.172.57.1
174.138.44.201
134.122.120.74
157.245.150.99
151.80.70.176
208.109.11.224
3.6.62.202
3.7.124.182
116.202.111.84
51.91.123.235
184.179.216.148
14.248.83.23
118.70.239.146
151.80.70.176
151.80.70.176
35.230.162.59
68.183.184.243
217.182.194.235
185.86.13.213
61.220.55.240
46.101.81.132
157.245.248.66
62.210.104.83
104.36.71.36
51.91.123.235
185.86.167.4
37.187.134.111
149.202.48.58
103.81.85.9
185.177.57.20
3.85.142.124
68.183.41.151
104.248.224.124
157.245.183.64
149.28.182.163
139.162.70.182
142.93.250.190
159.65.128.55
185.85.191.201
138.68.2.4
104.236.75.62
51.38.69.227
139.59.27.226
24.37.113.22
163.44.206.82
208.113.171.192
34.93.31.225
46.101.13.211
103.147.10.206
123.30.111.19
68.183.75.36
149.56.129.129
47.107.170.80
35.229.45.205
159.65.145.176
91.234.194.246
185.86.164.103
192.81.210.176
104.248.43.44
123.31.43.173
47.100.9.157
208.109.12.218
134.122.103.0
104.248.142.140
150.95.128.207
35.204.42.60
162.144.141.141
208.113.153.203
167.99.120.33
142.93.212.186
159.65.19.39
91.234.194.246
54.246.205.49
142.4.7.212
104.238.116.152
149.28.182.163
46.101.57.196
185.85.191.196
104.236.163.176
212.85.69.14
165.227.220.53
75.119.215.210
139.59.10.121
185.85.238.244
149.28.193.251
185.123.116.219
188.166.181.139
34.231.130.6
117.4.185.183
139.59.172.23
91.121.101.77
149.28.8.137
13.251.212.9
148.72.42.181
142.93.47.171
128.199.245.33
162.144.46.137
81.16.10.158
212.237.25.210
148.72.42.181
185.86.164.99
188.68.47.42
149.28.96.163
13.52.74.103
128.199.161.98
94.23.219.41
35.186.147.101
192.162.68.244
83.240.186.74
185.86.167.4
81.170.239.2
148.66.135.152
142.93.143.85
107.179.19.68
195.78.93.222
142.93.59.35
139.59.10.121
159.89.2.220
35.204.240.175
159.203.241.101
157.245.149.219
104.248.136.138
159.65.106.196
165.22.244.140
139.99.45.201
34.240.47.207
118.25.97.227
138.197.135.102
159.65.128.55
121.190.16.180
217.182.197.6
112.121.153.187
35.185.133.141
3.114.173.77
13.78.131.155
165.227.155.173
64.111.126.43
148.72.23.58
195.154.29.107
137.59.110.53
157.245.248.66
35.243.184.92
139.59.75.162
43.252.103.150
93.114.86.226
213.149.103.132
137.74.158.143
149.202.45.11
146.185.163.81
134.122.103.0
35.185.133.141
185.100.128.30
103.146.202.150
195.154.114.140
34.198.176.215
50.196.245.6
149.56.19.4
68.183.106.55
159.65.185.253
104.236.163.176
67.205.153.74
54.246.205.49
64.227.69.170
104.248.129.236
64.202.184.245
188.166.9.162
176.99.14.24
157.230.170.78
148.72.23.58
95.216.190.170
150.95.128.207
185.86.164.100
188.166.233.216
79.137.52.220
159.203.12.18
68.183.43.150
182.61.29.94
176.241.76.204
51.255.64.58
186.234.80.117
35.193.78.86
43.254.11.42
208.113.171.192
159.65.147.36
178.128.53.79
178.62.86.214
159.89.148.68
196.41.122.94
188.166.18.69
165.22.251.46
176.56.56.132
46.101.179.164
176.241.76.204
167.99.64.161
107.180.227.163
13.251.212.9
165.22.255.242
69.163.238.207
62.151.182.209
64.227.7.213
80.85.156.55
185.86.164.98
184.176.166.7
197.48.207.152
156.197.111.228
111.94.230.121
197.36.7.250
178.148.117.185
156.207.191.13
154.0.27.155
90.15.74.128
43.228.117.202
176.232.6.38
88.69.240.59
176.232.6.38
179.63.240.41
36.73.84.216
46.32.121.238
39.43.16.1
78.180.51.58
103.126.60.170
200.69.69.178
61.105.45.36
182.186.65.201
102.165.80.131
82.202.226.51
105.168.246.206
39.48.55.163
94.123.197.176
197.48.190.10
5.107.8.215
43.228.117.202
85.98.21.66
124.120.121.179
31.177.183.23
161.117.14.183
39.33.176.41
102.165.80.219
212.85.69.14
142.4.6.212
159.89.1.19
190.46.138.169
46.101.57.196
159.203.27.100
165.22.210.69
27.123.221.197
104.131.203.173
157.245.74.244
202.150.143.242
35.185.133.141
51.255.170.202
62.210.104.83
102.112.43.68
64.202.185.147
165.227.155.173
128.199.245.33
61.12.92.146
116.202.111.84
157.230.234.117
5.196.65.74
142.93.124.56
68.183.68.148
166.62.123.55
161.35.53.207
118.25.97.227
206.189.155.76
104.236.163.176
163.172.185.44
104.248.235.6
93.113.111.193
68.183.41.151
165.22.210.69
142.93.152.19
162.144.141.141
80.252.136.182
104.248.129.236
46.101.112.205
176.56.56.132
54.38.212.160
111.223.130.153
51.15.220.241
134.122.85.192
35.193.78.86
139.99.121.6
139.59.141.196
128.199.166.195
5.39.87.36
35.204.240.175
142.93.140.240
106.13.226.16
104.248.29.213
188.166.111.207
185.79.156.186
167.71.67.66
148.72.213.105
159.89.99.68
178.128.90.9
51.255.101.8
182.52.56.110
134.209.53.244
159.89.2.220
198.12.148.12
34.76.172.157
34.231.130.6
159.65.184.79
107.180.71.116
198.12.156.214
186.234.80.120
166.62.122.244
138.197.43.206
138.68.80.235
104.248.144.208
132.148.141.147
104.131.139.147
37.59.52.44
166.62.122.244
35.230.162.59
185.120.147.145
159.203.176.82
157.245.143.5
167.172.125.254
157.245.233.164
103.147.10.222
51.68.71.129
68.183.238.246
107.180.95.193
142.93.203.168
144.217.183.134
213.32.91.71
128.199.245.33
51.254.118.224
68.183.238.246
27.123.221.197
132.148.28.167
157.245.110.16
64.227.7.213
165.227.15.124
188.166.60.138
107.180.84.251
142.93.152.219
121.190.16.180
68.183.184.7
176.56.56.132
37.187.134.111
134.209.241.57
188.165.251.196
196.189.184.48
148.72.207.135
139.59.5.179
171.244.129.66
192.163.207.200
134.122.103.0
217.12.33.184
80.90.82.70
123.57.51.204
167.71.137.237
157.245.233.164
104.199.216.0
75.119.215.210
192.169.200.145
198.12.156.133
165.22.255.242
192.169.200.145
148.72.31.119
178.62.86.214
202.150.143.242
37.59.60.115
35.204.240.175
67.205.153.74
178.128.57.183
45.55.5.34
206.189.35.138
206.189.40.58
165.227.15.124
178.128.101.79
138.68.52.53
68.183.146.249
112.121.153.187
161.35.53.207
68.183.184.7
104.248.136.138
138.197.131.66
37.59.60.115
27.254.154.119
132.148.152.103
112.135.74.176
199.250.205.15
185.66.233.61
66.33.212.126
159.65.228.105
121.190.16.180
157.245.74.244
62.213.82.38
47.75.126.75
157.245.133.78
139.59.65.8
117.239.180.188
159.89.183.168
159.203.70.169
46.217.253.46
13.75.163.43
162.214.14.226
159.203.12.18
3.223.104.32
122.154.134.183
128.199.110.156
37.59.52.44
51.254.43.3
112.121.153.187
3.124.254.147
103.83.36.101
159.65.219.250
142.93.204.221
149.28.193.251
142.93.99.56
139.59.43.75
157.245.133.78
75.119.215.210
123.201.164.147
193.56.13.163
149.28.8.137
51.75.23.214
192.169.200.145
13.75.163.43
137.74.206.80
148.72.213.105
146.185.142.200
180.250.28.34
87.98.250.212
216.70.68.63
64.202.184.245
142.93.203.168
139.59.82.111
166.62.80.109
164.132.98.229
137.59.110.53
139.59.78.248
195.222.48.151
159.89.47.131
148.72.207.135
209.97.175.191
149.202.45.11
159.203.27.100
185.220.101.145
103.81.85.9
159.203.176.82
137.74.158.143
62.151.182.209
46.101.81.132
138.68.230.39
46.101.57.196
142.93.46.172
82.202.226.51
167.114.235.12
222.124.150.157
68.183.134.134
192.163.207.200
47.75.172.46
165.22.35.21
66.33.212.126
47.52.239.42
185.86.164.101
47.89.179.29
79.137.52.220
173.236.152.135
198.50.221.5
157.245.143.5
159.203.98.228
64.227.20.221
178.128.56.22
122.154.134.183
159.203.241.101
103.147.10.222
64.111.121.238
103.129.221.18
209.97.133.120
157.230.111.136
138.68.230.39
104.131.203.173
104.236.163.176
161.35.53.207
35.204.42.60
163.172.167.10
62.210.185.4
159.89.110.45
213.32.91.71
138.197.146.132
165.22.244.140
103.129.223.126
118.69.244.146
171.244.129.66
122.154.134.183
174.138.44.201
188.165.255.134
203.162.31.112
46.101.150.9
47.252.6.231
5.180.185.253
134.122.120.74
132.148.28.167
137.59.110.53
178.46.163.3
91.228.153.170
210.187.181.108
205.185.127.48
85.66.69.244

В итоге -  имеем более шести сотен IP-адресов, используемых неизвестным злоумышленником, для грубой брутфорс атаки. Несмотря на то, что использовались словари паролей с набором около 30000 слов, пароль от админки так и не был раскрыт атакующим.

Используйте правильные пароли! Не забывайте о безопасности своих ресурсов.

Понравилась статья?  Получайте обновления на RSS!
И еще тут будет текст...