|
|
RT，大佬们，这是说我攻击别人服务器了吗
Please be informed that we received a complaint regarding the activity from your IP address.
We are waiting for your reply.
In the meantime, we reserve the right to suspend the services in accordance with the Master Services Agreement, Acceptable Use Policy and applicable laws.
The respective complaint will follow-up to this letter.
Hello Abuse-Team,
your Server/Customer with the IP: *5.188.**.*** (xxxx.com) has attacked one of our servers/partners.
The attackers used the method/service: *ssh* on: *Sat, 11 Apr 2020 03:32:07 +0000*.
The time listed is from the server-time of the Blocklist-user who submitted the report.
The attack was reported to the Blocklist.de-System on: *Sat, 11 Apr 2020 02:29:42 +0200*
!!!Do not answer to this Mail!Use support@ or contact-form for Questions (no resolve-messages, no updates....) !!!
The IP has been automatically blocked for a period of time.For an IP to be blocked, it needs
to have made several failed logins (ssh, imap....), tried to log in for an "invalid user", or have
triggered several 5xx-Error-Codes (eg.Blacklist on email...), all during a short period of time.
The Server-Owner configures the number of failed attempts, and the time period they have
to occur in, in order to trigger a ban and report.Blocklist has no control over these settings.
Please check the machine behind the IP 5.188.**.** (xxxx.com) and fix the problem.
To search for AS-Number/IPs that you control, to see if any others have been infected/blocked, please go to:
https://www.blocklist.de/en/search.html?as=199524
If you need the logs in another format (rather than an attachment), please let us know.
You can see the Logfiles online again:https://www.blocklist.de/en/logs.html?rid=929582934&ip=5.188.**.**
You can parse this abuse report mail with X-ARF-Tools fromhttp://www.xarf.org/tools.htmle.g. validatexarf-php.tar.gz.
You can find more information about X-Arf V0.2 athttp://www.xarf.org/specification.html
This message will be sent again in one day if more attacks are reported to Blocklist.
In the attachment of this message you can find the original logs from the attacked system.
To pause this message for one week, you can use our "Stop Reports" feature on Blocklist.de to submit
the IP you want to stop recieving emails about, and the email you want to stop receiving them on.
If more attacks from your network are recognized after the seven day grace period, the reports will start
being sent again.
To pause these reports for one week:
https://www.blocklist.de/en/insert.html?ip=5.188.**.**&email=abuse@gcore.lu
We found this abuse email address in the Whois-Data from the IP under the SearchString "abuse-c (Ripe AbuseFinder)"
Reply to this message to let us know if you want us to send future reports to a different email.(e.g. to abuse-quiet or a special address)
------------------------------
blocklist.de Abuse-Team
This message was sent automatically.For questions please use our Contact-Form (autogenerated@/abuse-team@ is not monitored!):
https://www.blocklist.de/en/contact.html?RID=929582934
Logfiles:https://www.blocklist.de/en/logs.html?rid=929582934&ip=5.188.**.**
------------------------------
Reported-From:abuse-team@blocklist.de
Category: abuse
Report-Type: login-attack
Service: ssh
Version: 0.2
User-Agent: Fail2BanFeedBackScript blocklist.de V0.2
Date: Sat, 11 Apr 2020 03:32:07 +0000
Source-Type: ip-address
Source: 5.188.**.**
Port: 22
Report-ID:929582934@blocklist.de
Schema-URL:http://www.xarf.org/schema/abuse_login-attack_0.1.2.json
Attachment: text/plain
Apr 11 03:27:16 vh1 sshd[17276]: Address 5.188.**.** maps to xxxx.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Apr 11 03:27:16 vh1 sshd[17276]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.188.**.** user=root
Apr 11 03:27:18 vh1 sshd[17276]: Failed password for root from 5.188.**.** port 46716 ssh2
Apr 11 03:27:19 vh1 sshd[17277]: Received disconnect from 5.188.**.**: 11: Bye Bye
Apr 11 03:32:05 vh1 sshd[17739]: Address 5.188.**.** maps to xxxx.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT!
Apr 11 03:32:05 vh1 sshd[17739]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=5.188.**.** user=root
Apr 11 03:32:07 vh1 sshd[17739]: Failed password for root from 5.188.**.** port 38568 ssh2
Apr 11 03:32:07 vh1 sshd[17740]: Received disconnect from 5.188.**.**: 11: Bye Bye
机翻如下
请注意，我们收到了来自您IP地址的有关活动的投诉。
我们在等你的答复。
同时，我们保留根据主服务协议、可接受使用政策和适用法律暂停服务的权利。
相关投诉将在本函之后进行。
你好虐待小组，
您的IP为：*5.188.*.***（xxxx.com）的服务器/客户攻击了我们的一个服务器/合作伙伴。
攻击者使用了方法/服务：*ssh*on:*Sat，2020年4月11日03:32:07+0000*。
列出的时间是来自提交报告的阻止列表用户的服务器时间。
此攻击已于：2020年4月11日星期六02:29:42+0200向Blocklist.de-System报告*
!!!不要回复这封邮件！使用支持@或联系方式来回答问题（没有解决消息，没有更新…）！！！
IP已被自动阻止一段时间。要阻止IP，它需要
多次登录失败（ssh，imap….），试图登录“无效用户”，或
在短时间内触发了几个5xx错误代码（如电子邮件黑名单…）。
服务器所有者配置失败的尝试次数以及它们拥有的时间段
在中发生，以便触发禁令和报告。阻止列表无法控制这些设置。
请检查IP 5.188.*.**（xxxx.com）后面的机器并解决问题。
要搜索您控制的AS号码/IP，查看是否有其他人被感染/阻止，请转到：
https://www.blocklist.de/en/search.html？as=199524年
如果您需要其他格式的日志（而不是附件），请告知我们。
您可以再次在线查看日志文件：https://www.blocklist.de/en/logs.html？rid=929582934和ip=5.188.***
您可以使用X-ARF-Tools从http://www.xarf.org/Tools.htmle.g.validatexarf-php.tar.gz解析此滥用报告邮件。
有关X-Arf V0.2的更多信息，请访问http://www.xarf.org/specification.html
如果向阻止列表报告更多攻击，则此消息将在一天内再次发送。
在该邮件的附件中，您可以找到受攻击系统的原始日志。
要将此消息暂停一周，您可以使用Blocklist.de上的“停止报告”功能提交
你想停止接收邮件的IP地址，以及你想停止接收邮件的地址。
如果在七天的宽限期后，您的网络中发现更多攻击，则报告将开始
再次被发送。
要将这些报告暂停一周：
https://www.blocklist.de/en/insert.html？ip=5.188.*.**&email=abuse@gcore.lu
我们在来自IP的Whois数据中的搜索字符串“abuse-c（rime AbuseFinder）”下找到了这个滥用电子邮件地址
回复此邮件，让我们知道您是否希望我们将未来的报告发送到其他电子邮件。（例如滥用安静或特殊地址）
------------------------------
阻止列表.de滥用团队
此邮件是自动发送的。有关问题，请使用我们的联系人表单（不监视自动生成的@/滥用团队！）:
https://www.blocklist.de/en/contact.html？RID=929582934
日志文件：https://www.blocklist.de/en/logs.html？rid=929582934和ip=5.188.***
------------------------------
报告人：dause-team@blocklist.de
类别：虐待
报告类型：登录攻击
服务：ssh
版本：0.2
用户代理：Fail2BanFeedBackScript blocklist.de V0.2
日期：2020年4月11日星期六03:32:07+0000
源类型：ip地址
资料来源：5.188.***
端口：22
报告编号：929582934@blocklist.de
架构URL:http://www.xarf.org/Schema/abuse_login-attack_0.1.2.json
附件：文本/纯文本
4月11日03:27:16 vh1 sshd[17276]：地址5.188.*.**映射到xxxx.com，但这不会映射回地址-可能的入侵尝试！
4月11日03:27:16 vh1 sshd[17276]：pam_unix（sshd:auth）：身份验证失败；logname=uid=0 euid=0 tty=ssh ruser=rhost=5.188.*.**user=root
4月11日03:27:18 vh1 sshd[17276]：来自5.188的根用户密码失败。****端口46716 ssh2
4月11日03:27:19 vh1 sshd[17277]：收到5.188的断开连接。**.**:11:再见
4月11日03:32:05 vh1 sshd[17739]：地址5.188.*.**映射到xxxx.com，但这不会映射回地址-可能的入侵尝试！
4月11日03:32:05 vh1 sshd[17739]：pam_unix（sshd:auth）：身份验证失败；logname=uid=0 euid=0 tty=ssh ruser=rhost=5.188.*.**user=root
4月11日03:32:07 vh1 sshd[17739]：来自5.188的根用户密码失败。****端口38568 ssh2
4月11日03:32:07 vh1 sshd[17740]：收到5.188的断开连接。****:11:再见
|
|
发表于 2020-4-11 21:56:45
