AniNIX/RSS | OSINT Feed https://foundation.aninix.net/assets/img/AniNIX.png https://foundation.aninix.net/assets/img/AniNIX.png 2022-09-26T02:16:20Z AniNIX https://aninix.net/ 5.181.86.78/32 2023-01-16T21:44:07Z https://aninix.net/AniNIX/Wiki/raw/branch/main/rss/osint.xml#5.181.86.78 5.181.86.78/32 was detected using a variety of attacks against our 80/tcp/http listener for AniNIX/WebServer. Suricata detection rules classified the incoming threats as a variety of SQL injection methods and cross-site scripting. Total attack volume was 184. Attack Flood from CN, BR, KZ, and DigitalOcean 2022-12-23T18:19:59Z https://aninix.net/AniNIX/Wiki/raw/branch/main/rss/osint.xml#attack-flood-2022-12-23

Starting 2022/12/18, the AniNIX saw a rapid increase of threat traffic from subnets attributed to CN, BR, and KZ country codes -- this coincided with a concerted campaign being run from hosting provider DigitalOcean. While APT-style campaigns from CN are more or less expected, the large amount of traffic from DigitalOcean suggests the advent of a new campaign from that vendor. Other AniNIX users have reported similar attacks originating from DigitalOcean, but blocking the entire provider cuts off access to some local resources.

We are blocking the following subnets in response to this threat data: 8.213.129.0/24, 36.92.107.0/24, 43.157.15.0/24, 45.162.216.0/22, 46.101.128.0/17, 46.101.80.0/20, 61.177.0.0/16, 62.87.132.0/22, 64.227.0.0/17, 82.180.132.0/23, 85.152.0.0/17, 92.46.64.0/18, 159.223.0.0/16, and 218.92.0.0/16. If you have legitimate resources living in these spaces, we recommend hardening those resources and contacting us via Discord or IRC to receive an exception.

78.128.113.166/32 2022-12-15T01:59:59Z https://aninix.net/AniNIX/Wiki/raw/branch/main/rss/osint.xml#78.128.113.166 78.128.113.166/32 was detected using a variety of attacks against our 80/tcp/http listener for AniNIX/WebServer. Suricata detection rules classified the incoming threats as a variety of SQL injection methods and cross-site scripting. Total attack volume was 363. 141.98.9.24/32 2022-09-30T21:59:59Z https://aninix.net/AniNIX/Wiki/raw/branch/main/rss/osint.xml#141.98.9.24 141.98.9.24/32 was detected using a variety of attacks against our 80/tcp/http listener for AniNIX/WebServer. Suricata detection rules classified the incoming threats as a variety of SQL queries by URI, including "Attempt To Access MSSQL xp_cmdshell Stored Procedure Via URI". Total attack volume was 184. 31.184.195.114/32 2022-09-30T21:59:59Z https://aninix.net/AniNIX/Wiki/raw/branch/main/rss/osint.xml#31.184.195.114 31.184.195.114/32 was detected using a variety of attacks against our 80/tcp/http listener for AniNIX/WebServer. Suricata detection rules classified the incoming threats as attempted administrator gain, lwp-download, and CVE-2014-6271 exploits. Total attack volume was 254. 81.19.136.5/32 2022-09-30T21:59:59Z https://aninix.net/AniNIX/Wiki/raw/branch/main/rss/osint.xml#81.19.136.5 81.19.136.5/32 was detected using web application attacks against our 80/tcp/http listener for AniNIX/WebServer. Suricata detection rules classified the incoming threats as a variety of SQL injection attacks. Total attack volume was 1079. 194.165.16.68/32 2022-09-30T21:59:59Z https://aninix.net/AniNIX/Wiki/raw/branch/main/rss/osint.xml#194.165.16.68 194.165.16.68/32 was detected using web application attacks against our 80/tcp/http listener for AniNIX/WebServer. Suricata detection rules classified the incoming threats as a variety of SQL injection attacks. Total attack volume was 184. 91.191.209.54/32 2022-09-26T02:16:20Z https://aninix.net/AniNIX/Wiki/raw/branch/main/rss/osint.xml#91.191.209.54 91.191.209.54/32 was detected using web application attacks against our 80/tcp/http listener for AniNIX/WebServer. Suricata detection rules classified the incoming threats as a variety of SQL injection attacks. Total attack volume was 1080. 194.165.17.9/32 2022-09-26T02:16:20Z https://aninix.net/AniNIX/Wiki/raw/branch/main/rss/osint.xml#194.165.17.9 194.165.17.9/32 was detected using web application attacks against our 80/tcp/http listener for AniNIX/WebServer. Suricata detection rules classified the incoming threats as a variety of SQL injection attacks. Total attack volume was 184.