For the past year or so every few months when I am bored and have nothing to do I will take a look
at my router logs and see who and where they are trying to hack me from.
I know that 99 percent of the IP's in my log the owners have absolutely no idea what their machine is
doing behind their backs I hope that somehow they get the idea to Google their IP and find this post
and try to remedy it.
I first got interested in who was trying to hack my computer in the late 1990's when I got my first dial
up internet connection, I was using a firewall (can't remember the name) and it would log all the IP's
that were trying to access my computer, I would then scan the IP"s for services and most of the time
I would find something.
The funny thing about script kiddies back then was that they loved Yahoo Messenger, I guess they liked
bragging about who they had scanned or hacked, But the funny thing about messenger back then was
that it installed a server on port 80 of your computer with all the info about your account. There was
either very little or no warning at all about this during the install, If you dug deep into the settings you
could disable it but most people had no idea that they installed a server.
I remember connecting to their IP and scaring the hell out of a lot of script kiddies, Fun times were had
with all the things I would tell them either who I was (bullshit) or what I could or would do to them
(also bullshit).
About my Router
There is nothing special about my Router, It was supplied by my ISP 5 or so years ago, One of the options is to log
Include in Log
|
Attempted
access to allowed sites
|
Attempted
access to blocked sites and services
|
Connections
to the Web-based interface of this Router
|
Router
operation (startup, get time etc)
|
Known DoS
attacks and Port Scans
|
Port
Forwarding / Port Triggering
|
Wireless
access
|
A typical log looks
like this
Snippet:
[DoS attack: Smurf]
attack packets in last 20 sec from ip [37.36.153.255], Wednesday, Mar 29,2017
10:45:26
[DoS attack: Smurf]
attack packets in last 20 sec from ip [37.36.153.255], Wednesday, Mar 29,2017
10:45:03
[DoS attack: Smurf]
attack packets in last 20 sec from ip [71.3.9.255], Wednesday, Mar 29,2017
08:00:29
[DoS attack: Smurf]
attack packets in last 20 sec from ip [91.134.218.255], Wednesday, Mar 29,2017
06:28:44
[DoS attack: Smurf]
attack packets in last 20 sec from ip [188.238.96.255], Tuesday, Mar 28,2017
12:21:24
[DoS attack: Smurf]
attack packets in last 20 sec from ip [188.238.96.255], Tuesday, Mar 28,2017
12:16:43
[DoS attack: Smurf]
attack packets in last 20 sec from ip [188.238.96.255], Tuesday, Mar 28,2017
12:03:22
[DoS attack: Smurf]
attack packets in last 20 sec from ip [188.238.96.255], Tuesday, Mar 28,2017
12:02:03
[DoS attack: Smurf]
attack packets in last 20 sec from ip [93.138.85.255], Tuesday, Mar 28,2017
09:27:29
[DoS attack: Smurf]
attack packets in last 20 sec from ip [93.138.85.255], Tuesday, Mar 28,2017
09:22:50
[DoS attack: Smurf]
attack packets in last 20 sec from ip [93.138.85.255], Tuesday, Mar 28,2017
09:22:29
[DoS attack: Smurf]
attack packets in last 20 sec from ip [93.138.85.255], Tuesday, Mar 28,2017
09:21:18
[DoS attack: Smurf]
attack packets in last 20 sec from ip [93.138.85.255], Tuesday, Mar 28,2017
07:33:48
[DoS attack: Smurf]
attack packets in last 20 sec from ip [93.138.85.255], Tuesday, Mar 28,2017
07:29:00
[DoS attack: Smurf]
attack packets in last 20 sec from ip [93.138.85.255], Tuesday, Mar 28,2017
07:28:34
[DoS attack: Smurf]
attack packets in last 20 sec from ip [93.138.85.255], Tuesday, Mar 28,2017
07:27:24
[DoS attack: Smurf]
attack packets in last 20 sec from ip [24.156.209.255], Tuesday, Mar 28,2017
06:26:40
[DoS attack: Smurf]
attack packets in last 20 sec from ip [24.156.209.255], Tuesday, Mar 28,2017
06:22:13
[DoS attack: Smurf]
attack packets in last 20 sec from ip [5.54.255.255], Tuesday, Mar 28,2017
01:53:07
[DoS attack: Smurf]
attack packets in last 20 sec from ip [161.18.10.255], Tuesday, Mar 28,2017
01:52:43
[DoS attack:
Teardrop] attack packets in last 20 sec from ip [93.85.180.214], Monday, Mar
27,2017 13:53:41
[DoS attack: Smurf]
attack packets in last 20 sec from ip [112.203.105.255], Monday, Mar 27,2017
09:30:38
[DoS attack: FIN
Scan] attack packets in last 20 sec from ip [54.172.226.126], Sunday, Mar
26,2017 14:24:26
[DoS attack: Smurf]
attack packets in last 20 sec from ip [49.147.30.255], Saturday, Mar 25,2017
15:42:10
I use a few linux
commands to find out where these attacks are coming from.
Strip IP's
grep -o
'[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' log_mar30 >
strip0IP
Counting names
awk
'{for(w=1;w<=NF;w++) print $w}' strip0IP | sort | uniq -c | sort -nr
>uniqueIP
Remove the numbers
from counting IP's
grep -o
'[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' uniqueIP >
uniqueIP1
Find info on IP's
cat uniqueIP1 |
xargs -I% curl -s http://ipinfo.io/%/ |
paste -d","> detailinfo
I end up with this
Log March 23 to Mar
30 2017
198 37.36.153.255
8 93.138.85.255
4 188.238.96.255
3 49.147.30.255
2 93.142.192.255
2 24.156.209.255
1 93.85.180.214
1 91.134.218.255
1 80.91.166.255
1 71.3.9.255
1 5.54.255.255
1 54.172.226.126
1 40.138.170.255
1 36.70.140.255
1 178.221.36.255
1 176.59.38.255
1 167.60.134.255
1 161.18.10.255
1 112.203.105.255
{
"ip": "37.36.153.255",
"hostname": "No
Hostname",
"city": "Jalib Ash
Shuyukh",
"region": "Al Kuwayt",
"country": "KW",
"loc": "29.2586,47.9242",
"org": "AS42961 Mobile
Telecommunications Company"
}{
"ip": "93.138.85.255",
"hostname":
"93-138-85-255.adsl.net.t-com.hr",
"city": "Zagreb",
"region": "City of
Zagreb",
"country": "HR",
"loc": "45.7333,15.9667",
"org": "AS5391 Hrvatski
Telekom d.d.",
"postal": "10000"
}{
"ip": "188.238.96.255",
"hostname":
"mobile-access-bcee60-255.dhcp.inet.fi",
"city": "Vantaa",
"region": "Uusimaa",
"country": "FI",
"loc": "60.3131,24.9507",
"org": "AS1759 TeliaSonera
Finland Oyj",
"postal": "01300"
}{
"ip": "49.147.30.255",
"hostname": "No
Hostname",
"city": "",
"region": "",
"country": "PH",
"loc":
"14.5955,120.9721",
"org": "AS9299 Philippine Long
Distance Telephone Company"
}{
"ip": "93.142.192.255",
"hostname":
"93-142-192-255.adsl.net.t-com.hr",
"city": "Krizevci",
"region":
"Koprivnicko-Krizevacka Zupanija",
"country": "HR",
"loc": "46.0265,16.5595",
"org": "AS5391 Hrvatski
Telekom d.d.",
"postal": "48260"
}{
"ip": "24.156.209.255",
"hostname":
"d24-156-209-255.home4.cgocable.net",
"city": "Belleville",
"region": "Ontario",
"country": "CA",
"loc":
"44.1665,-77.4037",
"org": "AS7992 Cogeco
Cable",
"postal": "K8P"
}{
"ip": "93.85.180.214",
"hostname": "No
Hostname",
"city": "Minsk",
"region": "Minsk City",
"country": "BY",
"loc": "53.9000,27.5667",
"org": "AS6697 Republican
Unitary Telecommunication Enterprise Beltelecom"
}{
"ip": "91.134.218.255",
"hostname": "No
Hostname",
"city": "",
"region": "",
"country": "FR",
"loc": "48.8582,2.3387",
"org": "AS16276 OVH SAS"
}{
"ip": "80.91.166.255",
"hostname": "No
Hostname",
"city": "Dnipro",
"region": "Dnipropetrovska
Oblast'",
"country": "UA",
"loc": "48.4630,35.0390",
"org": "AS21219 PRIVATE JOINT
STOCK COMPANY DATAGROUP"
}{
"ip": "71.3.9.255",
"hostname":
"fl-71-3-9-255.dyn.embarqhsd.net",
"city": "Ocala",
"region": "Florida",
"country": "US",
"loc":
"29.0879,-82.1949",
"org": "AS2379 Embarq
Corporation",
"postal": "34476"
}{
"ip": "5.54.255.255",
"hostname": "No
Hostname",
"city": "Athens",
"region": "Attica",
"country": "GR",
"loc": "37.9833,23.7333",
"org": "AS3329
VODAFONE-PANAFON HELLENIC TELECOMMUNICATIONS COMPANY SA"
}{
"ip": "54.172.226.126",
"hostname":
"ec2-54-172-226-126.compute-1.amazonaws.com",
"city": "Ashburn",
"region": "Virginia",
"country": "US",
"loc":
"39.0481,-77.4728",
"org": "AS14618 Amazon.com,
Inc.",
"postal": "20149"
}{
"ip": "40.138.170.255",
"hostname":
"h255.170.138.40.static.ip.windstream.net",
"city": "Cleveland",
"region": "Georgia",
"country": "US",
"loc":
"34.5970,-83.7632",
"org": "AS7029 Windstream
Communications LLC",
"postal": "30528"
}{
"ip": "36.70.140.255",
"hostname": "No
Hostname",
"city": "Jakarta",
"region": "Jakarta",
"country": "ID",
"loc":
"-6.1744,106.8294",
"org": "AS17974 PT
Telekomunikasi Indonesia"
}{
"ip": "178.221.36.255",
"hostname": "No
Hostname",
"city": "Belgrade",
"region": "",
"country": "RS",
"loc": "44.8186,20.4681",
"org": "AS8400 TELEKOM SRBIJA
a.d."
}{
"ip": "176.59.38.255",
"hostname":
"enode.176.59.38.255.tele2.ru",
"city": "Moscow",
"region": "Moscow City",
"country": "RU",
"loc": "55.7522,37.6156",
"org": "AS12958 T2 Mobile
LLC",
"postal": "121374"
}{
"ip": "167.60.134.255",
"hostname": "No
Hostname",
"city": "Montevideo",
"region": "Departamento de
Montevideo",
"country": "UY",
"loc":
"-34.8581,-56.1708",
"org": "AS6057 Administracion
Nacional de Telecomunicaciones"
}{
"ip": "161.18.10.255",
"hostname": "No
Hostname",
"city": "Bogotá",
"region": "Bogota D.C.",
"country": "CO",
"loc": "4.6492,-74.0628",
"org": "AS3816 COLOMBIA
TELECOMUNICACIONES S.A. ESP"
}{
"ip": "112.203.105.255",
"hostname": "No
Hostname",
"city": "Addition Hills",
"region": "National Capital
Region",
"country": "PH",
"loc":
"14.5946,121.0391",
"org": "AS9299 Philippine Long
Distance Telephone Company",
"postal": "0410"
}
