近日,本行政单位收到国家计算机网络应急技术处理协调中心的函件,说我单位固定外网IP感染了暗云3木马。
经用官方推荐的查杀软件未在本局域网各终端都未查询到该木马。
但分析外网路由器log时发现在大量远程登陆失败的记录,如下,请工程师们分析一下,是否这些IP地址属于暗云DDOS攻击的,
(已经做过IP telnet 登录过滤),有没有知情的,受到DDOS攻击也被国家互联网应急中心列入感染IP范围?应急中心如何批量查询IP是否感染暗云。
谢谢!
%Jul 5 03:53:54:513 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:54:516 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:55:020 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:55:020 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:55:023 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:55:042 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:55:157 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:55:164 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:55:164 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:55:167 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:55:285 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:55:292 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:55:294 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:55:336 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:55:508 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:55:512 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:55:512 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:53:55:517 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:54:17:845 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
%Jul 5 03:54:17:850 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 58.211.242.211 on VTY0 due to source IP restriction.
****************************
%Jul 5 04:35:37:839 2017 ******** VTY/5/VTY_LOG: SSH User failed to login from 124.68.10.20 on VYT0 due to source IP restriction.
****************************
%Jul 5 04:38:05:608 2017 ******** VTY/5/VTY_LOG: TELNET user failed to login from 45.25.218.10 on VTY0 due to source IP restriction.
%Jul 5 04:47:56:186 2017 ******** VTY/5/VTY_LOG: SSH User failed to login from 122.4.82.188 on VYT0 due to source IP restriction.
****************************
摘录几条,以下记录相同,只是IP不同
摘取IP如下
58.211.242.211
187.7.234.140
141.212.122.96
42.49.125.167
121.12.105.49
76.64.128.190
200.54.155.102
178.47.103.249
179.183.175.107
211.192.103.29
173.177.183.135
189.58.31.43
181.234.41.88
124.68.10.20
45.25.218.10
122.4.82.188
188.17.8.134
210.113.231.216
58.244.243.30
88.87.252.2
112.27.91.207
183.3.234.45
183.3.234.48
183.250.89.39
183.3.234.44
183.3.234.45
183.3.234.44
183.3.234.45
183.3.234.46
183.3.234.47
183.3.234.45
183.3.234.44
183.3.234.47
121.12.105.60
183.3.234.45
183.3.234.44
183.3.234.47
183.3.234.45
61.160.196.107
223.8.36.57
87.216.171.127
113.69.131.142
183.250.89.39
31.162.117.252
88.249.13.16
88.250.209.56
91.211.1.100
201.178.247.69
114.35.228.112
64.211.24.227
109.255.96.145
201.41.165.154
42.49.125.167
77.76.160.238
190.175.254.144
70.39.30.121
67.22.195.189
41.115.34.208
31.5.107.181
191.201.67.105
36.75.15.17
42.159.122.36
111.38.25.81
218.2.197.240
91.211.1.100
180.176.245.87
103.79.143.117
(0)
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明