<![CDATA[Bezbedan Balkan - Honeypots]]> https://bezbedanbalkan.net/ Fri, 06 Nov 2026 08:04:44 +0000 MyBB <![CDATA[SOX honeypot mreže prikazana na RIPE SEE]]> https://bezbedanbalkan.net/thread-2409.html Tue, 21 Apr 2026 13:58:19 +0000 milos_rs]]> https://bezbedanbalkan.net/thread-2409.html RIPE SEE 14 Belgrade - South East Europe Meeting - 21-22 april 2026 Nenad Krajnovic iz SOXa je prezentovao Honeypot mrežu postavljenu u okviru samog SOXa...

cela prezentacija je na https://pretalx.ripe.net/see-14/talk/EAQPZR/ a izdvojiću podeljene slajdove vezane za domaće IP adrese koje su upale u honeypot :

.png honey1.png Size: 453.76 KB  Downloads: 276


I šta su te IP adrese tražile :

.png honey2.png Size: 282.42 KB  Downloads: 307


Ovako im izgleda honeypot na Shodan-u, ne znam koliko ovakav Honeypot može biti zanimljiv, hvataće uglavnom automatizovane skenere i brute force pokušaje provaljivanja na SSH i druge servise...

.png honey3.png Size: 773.64 KB  Downloads: 277


Takođe je pomenuo da rade na nekom projektu ukrštavanja honeypot podataka sa netflow podacima kojima raspolaže SOX radi dubljeg praćenja napadača i identifikovanju krajnje tačke koja je pod napadom, ali opet ne verujem da će pravi napadači pasti na ovakav honeypot i upasti u takvu analizu nego će već imati sve što im treba za napad kupljeno od brokera početnog pristupa (Initial access brokers - IAB).

.png honey4.png Size: 307.59 KB  Downloads: 270


Zanimljiv projekat za opšte statistike ali slab indikator pravih napada usled ogromne količine nasumičnog skeniranja interneta od strane zlonamernih i dobronamernih aktera, to je kao traženje igle u plastu sena.]]> RIPE SEE 14 Belgrade - South East Europe Meeting - 21-22 april 2026 Nenad Krajnovic iz SOXa je prezentovao Honeypot mrežu postavljenu u okviru samog SOXa...

cela prezentacija je na https://pretalx.ripe.net/see-14/talk/EAQPZR/ a izdvojiću podeljene slajdove vezane za domaće IP adrese koje su upale u honeypot :

.png honey1.png Size: 453.76 KB  Downloads: 276


I šta su te IP adrese tražile :

.png honey2.png Size: 282.42 KB  Downloads: 307


Ovako im izgleda honeypot na Shodan-u, ne znam koliko ovakav Honeypot može biti zanimljiv, hvataće uglavnom automatizovane skenere i brute force pokušaje provaljivanja na SSH i druge servise...

.png honey3.png Size: 773.64 KB  Downloads: 277


Takođe je pomenuo da rade na nekom projektu ukrštavanja honeypot podataka sa netflow podacima kojima raspolaže SOX radi dubljeg praćenja napadača i identifikovanju krajnje tačke koja je pod napadom, ali opet ne verujem da će pravi napadači pasti na ovakav honeypot i upasti u takvu analizu nego će već imati sve što im treba za napad kupljeno od brokera početnog pristupa (Initial access brokers - IAB).

.png honey4.png Size: 307.59 KB  Downloads: 270


Zanimljiv projekat za opšte statistike ali slab indikator pravih napada usled ogromne količine nasumičnog skeniranja interneta od strane zlonamernih i dobronamernih aktera, to je kao traženje igle u plastu sena.]]> <![CDATA[NEW Kompromitovane IP adrese lista]]> https://bezbedanbalkan.net/thread-880.html Mon, 23 Oct 2023 15:30:17 +0000 VincaSec]]> https://bezbedanbalkan.net/thread-880.html https://www.abuseipdb.com/check-block/94.127.7.0/24
94.127.7.138 - 2023-10-23 15:34:39
94.127.7.140 - 2023-10-17 06:49:29
94.127.7.141 - 2023-09-20 09:49:18
94.127.7.143 - 2021-10-07 08:02:33
94.127.7.144 - 2023-10-20 12:43:48
94.127.7.145 - 2023-08-17 08:49:58
94.127.7.147 - 2023-10-10 13:04:18
94.127.7.149 - 2023-09-29 19:49:26
94.127.7.154 - 2023-09-25 09:49:55
94.127.7.164 - 2021-03-19 04:09:56
94.127.7.166 - 2023-10-02 10:08:22
94.127.7.168 - 2022-09-19 07:26:14
94.127.7.172 - 2023-08-08 12:49:08
94.127.7.176 - 2023-08-29 09:59:39
94.127.7.178 - 2023-08:30 07:21:01
94.127.7.180 - 2023-07-27 11:19:33
94.127.7.184 - 2022-09-08 08:12:16
94.127.7.186 - 2023-09-18 11:49:36
94.127.7.187 - 2023-08-23 13:05:36
94.127.7.188 - 2023-09-20 20:38:28
94.127.7.190 - 2023-10-03 08:53:42

ISP: Kancelarija za Informacione Tehnologije i Elektronsku Upravu
https://www.abuseipdb.com/check-block/195.222.96.0/24
https://www.abuseipdb.com/check-block/195.222.99.0/24
195.222.96.24 - 2021-11-24 03:31:24
195.222.96.143 - 2020-12-29 02:42:28
195.222.96.144 - 2022-09-26 01:22:42
195.222.99.153 - 2023-05-18 04:12:12
195.222.99.184 - 2023-06-15 11:52:08
195.222.99.225 - 2022-11-25 10:14:51
195.222.99.226 - 2022-11-25 10:14:30


ISP:Webglobe s.r.o.
https://www.abuseipdb.com/check-block/185.102.77.0/24
185.102.77.1 - 2023-07-16 17:58:07
185.102.77.14 - 2023-04-20 14:39:33
185.102.77.42 - 2023-06-29 05:50:41
185.102.77.50 - 2023-06-04 04:07:21
185.102.77.67 - 2023-09-05 11:49:30


ISP: Drustvo za telekomunikacije Orion telekom doo Beograd-Zemun
https://www.abuseipdb.com/check-block/109.111.252.0/24
109.111.252.2 - 2022-12-15 23:55:59
109.111.252.21 - 2021-09-28 02:20:36
109.111.252.23 - 2022-04-15 07:03:45
109.111.252.38 - 2021-02-15 18:48:58
109.111.252.61 - 2021-04-26 23:33:21
109.111.252.72 - 2021-10-19 21:57:45
109.111.252.76 - 2023-09-27 14:49:13
109.111.252.82 - 2021-08-11 14:37:54
109.111.252.90 - 2022-05-08 19:35:33
109.111.252.94 - 2022-07-12 00:25:47
109.111.252.104 - 2022-02-12 03:23:46
109.111.252.125 - 2023-09-20 10:19:01
109.111.252.126 - 2022-07-14 10:22:08
109.111.252.141 - 2022-09-01 21:26:51

ISP: McLoud DOO
https://www.abuseipdb.com/check-block/92.249.52.0/24
92.249.52.88 - 2021-09-01 10:10:26
92.249.52.124 - 2022-11-29 09:02:35
92.249.52.125 - 2021-08-14 05:32:42
92.249.52.126 - 2021-08-14 05:32:44

ISP: Telekom Srbija
https://www.abuseipdb.com/check-block/212.200.255.0/24
212.200.255.30 - 2021-11-25 07:54:51
212.200.255.35 - 2022-11-17 06:13:11
212.200.255.43 - 2023-09-23 06:09:37
109.92.203.38 - 2023-05-02 11:03:54
109.92.203.42 - 2022-04-23 06:41:06
109.92.203.71 - 2023-02-08 00:02:06
109.92.203.214 - 2023-10-30 14:30:23


ISP: Infostud 3 doo Subotica
https://www.abuseipdb.com/check-block/185.222.73.0/24
185.222.73.5 - 2022-01-24 07:32:08
185.222.73.46 - 2023-08-29 09:53:11
185.222.73.47 - 2023-08-15 07:50:09
185.222.73.48 - 2021-10-16 18:00:33
185.222.73.61 - 2022-01-24 07:32:19

ISP: Mainstream doo Beograd
https://www.abuseipdb.com/check-block/185.222.73.0/24

185.222.73.5 - 2022-01-24 07:32:08
185.222.73.46 - 2023-08-29 09:53:11
185.222.73.47 - 2023-08-15 07:50:09
185.222.73.48 - 2021-10-16 18:00:33
185.222.73.61 - 2022-01-24 07:32:19


ISP:TELEKOM SRBIJA a.d (VojskaSrbije-NET)
https://www.abuseipdb.com/check-block/212.200.34.0/24

212.200.34.67 - 2022-08-18 22:47:27
212.200.34.201 - 2023-07-27 15:37:58
212.200.34.202 - 2021-05-19 00:39:33
212.200.34.204 - 2022-01-06 04:35:16
212.200.34.205 - 2021-05-13 07:42:10
212.200.34.206 - 2023-03-30 15:54:29
212.200.34.208 - 2023-03-05 18:46:50
212.200.34.209 - 2023-05-08 13:23:26
212.200.34.210 - 2023-10-24 04:15:48
212.200.34.211 - 2023-10-19 23:55:29
212.200.34.212 - 2022-03-26 09:14:53
212.200.34.213 - 2022-04-18 02:04:06
212.200.34.214 - 2022-03-30 11:54:45
212.200.34.216 - 2021-06-24 01:45:26
212.200.34.217 - 2021-06-28 12:11:41


ISP: NetOps Ltd.
https://www.abuseipdb.com/check-block/185.119.89.0/24

185.119.89.31 - 2022-05-02 07:39:13
185.119.89.55 - 2020-11-29 23:48:33
185.119.89.58 - 2021-09-01 02:19:02
185.119.89.59 - 2022-05-11 08:02:12
185.119.89.60 - 2023-04-04 19:19:21
185.119.89.81 - 2022-11-05 19:20:18
185.119.89.82 - 2022-06-14 16:39:40
185.119.89.83 - 2022-05-09 20:39:22
185.119.89.84 - 2021-02-04 13:05:40
185.119.89.85 - 2021-02-09 14:34:30
185.119.89.86 - 2021-02-10 10:28:28
185.119.89.88 - 2022-11-02 12:21:43
185.119.89.89 - 2021-03-03 18:17:42
185.119.89.91 - 2022-07-05 20:40:00
185.119.89.92 - 2022-09-21 17:58:12
185.119.89.95 - 2022-10-10 16:46:07
185.119.89.96 - 2022-08-04 15:00:14
185.119.89.97 - 2022-06-27 11:39:23
185.119.89.98 - 2021-12-31 04:39:01
185.119.89.99 - 2021-04-27 19:09:31
185.119.89.100 - 2022-05-04 11:39:18
185.119.89.101 - 2022-05-17 13:13:48
185.119.89.102 - 2022-07-02 07:39:26
185.119.89.103 - 2022-09-21 17:58:12
185.119.89.104 - 2021-10-29 13:10:29
185.119.89.105 - 2022-06-29 07:39:26
185.119.89.111 - 2021-07-13 06:56:03
185.119.89.133 - 2022-04-16 07:57:05
185.119.89.183 - 2022-12-26 01:34:30
185.119.89.199 - 2023-09-28 03:00:33
185.119.89.212 - 2022-08-21 17:08:02
185.119.89.220 - 2022-06-22 18:39:29
185.119.89.235 - 2023-02-04 11:51:20
185.119.89.241 - 2021-11-25 10:10:04


ISP:Sat-Trakt D.O.O.
https://www.abuseipdb.com/check-block/185.156.154.0/24

185.156.154.43 - 2023-10-28 22:02:07
185.156.154.116 - 2023-03-04 18:17:10
185.156.154.129 - 2023-03-13 05:33:39
185.156.154.155 - 2023-09-13 13:20:20


ISP:Krajnalic Komunikacije d.o.o.
https://www.abuseipdb.com/check-block/37.220.78.0/24

37.220.78.3 - 2022-06-25 04:53:14
37.220.78.15 - 2023-03-22 12:34:20
37.220.78.30 - 2022-07-23 05:39:16
37.220.78.39 - 2022-12-07 07:43:01
37.220.78.40 - 2021-11-28 19:42:04
37.220.78.41 - 2023-10-30 11:51:35
37.220.78.44 - 2022-12-07 07:43:01
37.220.78.47 - 2023-03-04 02:21:22
37.220.78.72 - 2022-12-07 07:43:01
37.220.78.108 - 2021-09-15 11:11:16
37.220.78.123 - 2023-02-07 12:47:52
37.220.78.143 - 2023-09-12 08:22:05
37.220.78.154 - 2022-01-24 02:19:41
37.220.78.165 - 2021-05-02 03:02:49
37.220.78.181 - 2022-01-27 02:19:23
37.220.78.186 - 2023-03-14 10:09:35
37.220.78.208 - 2022-12-07 07:43:01
37.220.78.210 - 2023-01-28 19:17:02
37.220.78.212 - 2021-11-29 19:15:32
37.220.78.227 - 2022-04-30 04:04:30
37.220.78.235 - 2022-06-01 05:04:56
37.220.78.243 - 2021-03-07 15:24:42
37.220.78.255 - 2023-08-25 18:04:25


ISP:iPKO Telecommunications LLC
https://www.abuseipdb.com/check-block/46.99.144.0/24

46.99.144.11 - 2021-03-28 21:20:01
46.99.144.15 - 2022-07-23 03:53:31
46.99.144.22 - 2020-11-30 08:56:04
46.99.144.37 - 2021-08-26 01:00:02
46.99.144.43 - 2023-09-19 13:01:56
46.99.144.47 - 2021-03-30 03:39:17
46.99.144.52 - 2021-11-05 10:41:51
46.99.144.54 - 2021-04-10 20:03:20
46.99.144.55 - 2021-08:17 07:13:57
46.99.144.56 - 2020-11-27 06:48:56
46.99.144.67 - 2021-02-17 02:39:13
46.99.144.68 - 2021-09-30 06:06:18
46.99.144.69 - 2020-11-25 18:14:58
46.99.144.70 - 2021-09-14 20:41:28
46.99.144.75 - 2020-12:15 03:11:56
46.99.144.83 - 2021-08-07 20:46:22
46.99.144.84 - 2021-06:23 03:39:21
46.99.144.87 - 2021-02:26 17:08:27
46.99.144.91 - 2020-11:22 17:06:56
46.99.144.100 - 2020-11:30 10:45:39
46.99.144.101 - 2022-09:12 11:14:01
46.99.144.113 - 2023-06:13 15:19:53
46.99.144.116 - 2022-07:03 16:39:33
46.99.144.118 - 2020-12:16 16:55:06
46.99.144.121 - 2021-08:08 20:52:44
46.99.144.126 - 2021-08:08 11:04:18
46.99.144.154 - 2021-06:01 22:11:57
46.99.144.156 - 2021-10:22 06:35:14
46.99.144.196 - 2023-10-29 23:47:15
46.99.144.227 - 2023-10-29 23:47:39
46.99.144.246 - 2021-05:30 13:39:10
46.99.144.249 - 2020-12:22 14:05:30

ISP:Abakus Backa Palanka
https://www.abuseipdb.com/check-block/46.17.127.0/24

46.17.127.2 - 2023-03-27 02:26:12
46.17.127.3 - 2022-06-22 14:10:35
46.17.127.4 - 2021-07-13 21:09:34
46.17.127.6 - 2023-07-21 13:49:33
46.17.127.7 - 2023-08-22 17:00:27
46.17.127.11 - 2023-09-15 22:00:30
46.17.127.41 - 2023-04-15 13:03:30
46.17.127.60 - 2021-09-29 18:09:35
46.17.127.66 - 2023-09-01 22:21:56
46.17.127.90 - 2023-04-07 17:11:53
46.17.127.117 - 2023-10-22 18:59:46
46.17.127.119 - 2023-03-25 01:48:16
46.17.127.170 - 2021-04-01 05:57:16
46.17.127.218 - 2021-07-27 23:19:21
46.17.127.220 - 2023-06-27 08:43:01


ISP:M247 Europe SRL
https://www.abuseipdb.com/check-block/152.89.160.0/24

152.89.160.42 - 2023-03-29 04:27:22
152.89.160.50 - 2023-09-23 10:52:34
152.89.160.60 - 2022-05-10 18:00:19
152.89.160.62 - 2022-05-11 01:00:09
152.89.160.98 - 2023-08-23 23:04:20
152.89.160.99 - 2023-10-17 17:56:07
152.89.160.100 - 2023-10-30 01:38:28
152.89.160.101 - 2023-10-16 04:53:28
152.89.160.102 - 2023-08:11 00:05:11
152.89.160.103 - 2023-10-04 10:15:08
152.89.160.104 - 2022-12-31 13:19:54
152.89.160.105 - 2023-09-16 10:53:09
152.89.160.106 - 2023-10-01 11:13:21
152.89.160.107 - 2023-10-05 18:52:48
152.89.160.108 - 2023-09-26 11:19:12
152.89.160.109 - 2023-06-08 18:22:05
152.89.160.115 - 2023-09-15 00:26:21
152.89.160.116 - 2022-06-15 03:22:08
152.89.160.118 - 2022-05-11 21:21:36
152.89.160.131 - 2023-10-28 07:42:45
152.89.160.142 - 2023-01-27 00:54:20
152.89.160.148 - 2022-05-30 01:30:12
152.89.160.150 - 2022-05-26 18:50:50
152.89.160.180 - 2022-06-12 15:12:48
152.89.160.182 - 2022-06-12 16:34:42
152.89.160.183 - 2023-02-07 13:43:20
152.89.160.184 - 2023-02-20 13:59:56
152.89.160.185 - 2023-01-06 03:15:07
152.89.160.186 - 2022-02-26 22:16:45
152.89.160.187 - 2022-12-19 18:13:41
152.89.160.188 - 2022-12-13 06:02:31
152.89.160.189 - 2023-01-04 10:13:15
152.89.160.190 - 2021-10-24 19:00:10
152.89.160.211 - 2021-06-08 07:12:30
152.89.160.212 - 2022-05-07 16:24:56
152.89.160.214 - 2022-04-22 15:15:58
152.89.160.216 - 2021-04-01 14:16:36
152.89.160.242 - 2023-09-30 06:30:53
152.89.160.245 - 2022-09-15 17:22:54
152.89.160.253 - 2022-03-22 13:05:40]]> https://www.abuseipdb.com/check-block/94.127.7.0/24
94.127.7.138 - 2023-10-23 15:34:39
94.127.7.140 - 2023-10-17 06:49:29
94.127.7.141 - 2023-09-20 09:49:18
94.127.7.143 - 2021-10-07 08:02:33
94.127.7.144 - 2023-10-20 12:43:48
94.127.7.145 - 2023-08-17 08:49:58
94.127.7.147 - 2023-10-10 13:04:18
94.127.7.149 - 2023-09-29 19:49:26
94.127.7.154 - 2023-09-25 09:49:55
94.127.7.164 - 2021-03-19 04:09:56
94.127.7.166 - 2023-10-02 10:08:22
94.127.7.168 - 2022-09-19 07:26:14
94.127.7.172 - 2023-08-08 12:49:08
94.127.7.176 - 2023-08-29 09:59:39
94.127.7.178 - 2023-08:30 07:21:01
94.127.7.180 - 2023-07-27 11:19:33
94.127.7.184 - 2022-09-08 08:12:16
94.127.7.186 - 2023-09-18 11:49:36
94.127.7.187 - 2023-08-23 13:05:36
94.127.7.188 - 2023-09-20 20:38:28
94.127.7.190 - 2023-10-03 08:53:42

ISP: Kancelarija za Informacione Tehnologije i Elektronsku Upravu
https://www.abuseipdb.com/check-block/195.222.96.0/24
https://www.abuseipdb.com/check-block/195.222.99.0/24
195.222.96.24 - 2021-11-24 03:31:24
195.222.96.143 - 2020-12-29 02:42:28
195.222.96.144 - 2022-09-26 01:22:42
195.222.99.153 - 2023-05-18 04:12:12
195.222.99.184 - 2023-06-15 11:52:08
195.222.99.225 - 2022-11-25 10:14:51
195.222.99.226 - 2022-11-25 10:14:30


ISP:Webglobe s.r.o.
https://www.abuseipdb.com/check-block/185.102.77.0/24
185.102.77.1 - 2023-07-16 17:58:07
185.102.77.14 - 2023-04-20 14:39:33
185.102.77.42 - 2023-06-29 05:50:41
185.102.77.50 - 2023-06-04 04:07:21
185.102.77.67 - 2023-09-05 11:49:30


ISP: Drustvo za telekomunikacije Orion telekom doo Beograd-Zemun
https://www.abuseipdb.com/check-block/109.111.252.0/24
109.111.252.2 - 2022-12-15 23:55:59
109.111.252.21 - 2021-09-28 02:20:36
109.111.252.23 - 2022-04-15 07:03:45
109.111.252.38 - 2021-02-15 18:48:58
109.111.252.61 - 2021-04-26 23:33:21
109.111.252.72 - 2021-10-19 21:57:45
109.111.252.76 - 2023-09-27 14:49:13
109.111.252.82 - 2021-08-11 14:37:54
109.111.252.90 - 2022-05-08 19:35:33
109.111.252.94 - 2022-07-12 00:25:47
109.111.252.104 - 2022-02-12 03:23:46
109.111.252.125 - 2023-09-20 10:19:01
109.111.252.126 - 2022-07-14 10:22:08
109.111.252.141 - 2022-09-01 21:26:51

ISP: McLoud DOO
https://www.abuseipdb.com/check-block/92.249.52.0/24
92.249.52.88 - 2021-09-01 10:10:26
92.249.52.124 - 2022-11-29 09:02:35
92.249.52.125 - 2021-08-14 05:32:42
92.249.52.126 - 2021-08-14 05:32:44

ISP: Telekom Srbija
https://www.abuseipdb.com/check-block/212.200.255.0/24
212.200.255.30 - 2021-11-25 07:54:51
212.200.255.35 - 2022-11-17 06:13:11
212.200.255.43 - 2023-09-23 06:09:37
109.92.203.38 - 2023-05-02 11:03:54
109.92.203.42 - 2022-04-23 06:41:06
109.92.203.71 - 2023-02-08 00:02:06
109.92.203.214 - 2023-10-30 14:30:23


ISP: Infostud 3 doo Subotica
https://www.abuseipdb.com/check-block/185.222.73.0/24
185.222.73.5 - 2022-01-24 07:32:08
185.222.73.46 - 2023-08-29 09:53:11
185.222.73.47 - 2023-08-15 07:50:09
185.222.73.48 - 2021-10-16 18:00:33
185.222.73.61 - 2022-01-24 07:32:19

ISP: Mainstream doo Beograd
https://www.abuseipdb.com/check-block/185.222.73.0/24

185.222.73.5 - 2022-01-24 07:32:08
185.222.73.46 - 2023-08-29 09:53:11
185.222.73.47 - 2023-08-15 07:50:09
185.222.73.48 - 2021-10-16 18:00:33
185.222.73.61 - 2022-01-24 07:32:19


ISP:TELEKOM SRBIJA a.d (VojskaSrbije-NET)
https://www.abuseipdb.com/check-block/212.200.34.0/24

212.200.34.67 - 2022-08-18 22:47:27
212.200.34.201 - 2023-07-27 15:37:58
212.200.34.202 - 2021-05-19 00:39:33
212.200.34.204 - 2022-01-06 04:35:16
212.200.34.205 - 2021-05-13 07:42:10
212.200.34.206 - 2023-03-30 15:54:29
212.200.34.208 - 2023-03-05 18:46:50
212.200.34.209 - 2023-05-08 13:23:26
212.200.34.210 - 2023-10-24 04:15:48
212.200.34.211 - 2023-10-19 23:55:29
212.200.34.212 - 2022-03-26 09:14:53
212.200.34.213 - 2022-04-18 02:04:06
212.200.34.214 - 2022-03-30 11:54:45
212.200.34.216 - 2021-06-24 01:45:26
212.200.34.217 - 2021-06-28 12:11:41


ISP: NetOps Ltd.
https://www.abuseipdb.com/check-block/185.119.89.0/24

185.119.89.31 - 2022-05-02 07:39:13
185.119.89.55 - 2020-11-29 23:48:33
185.119.89.58 - 2021-09-01 02:19:02
185.119.89.59 - 2022-05-11 08:02:12
185.119.89.60 - 2023-04-04 19:19:21
185.119.89.81 - 2022-11-05 19:20:18
185.119.89.82 - 2022-06-14 16:39:40
185.119.89.83 - 2022-05-09 20:39:22
185.119.89.84 - 2021-02-04 13:05:40
185.119.89.85 - 2021-02-09 14:34:30
185.119.89.86 - 2021-02-10 10:28:28
185.119.89.88 - 2022-11-02 12:21:43
185.119.89.89 - 2021-03-03 18:17:42
185.119.89.91 - 2022-07-05 20:40:00
185.119.89.92 - 2022-09-21 17:58:12
185.119.89.95 - 2022-10-10 16:46:07
185.119.89.96 - 2022-08-04 15:00:14
185.119.89.97 - 2022-06-27 11:39:23
185.119.89.98 - 2021-12-31 04:39:01
185.119.89.99 - 2021-04-27 19:09:31
185.119.89.100 - 2022-05-04 11:39:18
185.119.89.101 - 2022-05-17 13:13:48
185.119.89.102 - 2022-07-02 07:39:26
185.119.89.103 - 2022-09-21 17:58:12
185.119.89.104 - 2021-10-29 13:10:29
185.119.89.105 - 2022-06-29 07:39:26
185.119.89.111 - 2021-07-13 06:56:03
185.119.89.133 - 2022-04-16 07:57:05
185.119.89.183 - 2022-12-26 01:34:30
185.119.89.199 - 2023-09-28 03:00:33
185.119.89.212 - 2022-08-21 17:08:02
185.119.89.220 - 2022-06-22 18:39:29
185.119.89.235 - 2023-02-04 11:51:20
185.119.89.241 - 2021-11-25 10:10:04


ISP:Sat-Trakt D.O.O.
https://www.abuseipdb.com/check-block/185.156.154.0/24

185.156.154.43 - 2023-10-28 22:02:07
185.156.154.116 - 2023-03-04 18:17:10
185.156.154.129 - 2023-03-13 05:33:39
185.156.154.155 - 2023-09-13 13:20:20


ISP:Krajnalic Komunikacije d.o.o.
https://www.abuseipdb.com/check-block/37.220.78.0/24

37.220.78.3 - 2022-06-25 04:53:14
37.220.78.15 - 2023-03-22 12:34:20
37.220.78.30 - 2022-07-23 05:39:16
37.220.78.39 - 2022-12-07 07:43:01
37.220.78.40 - 2021-11-28 19:42:04
37.220.78.41 - 2023-10-30 11:51:35
37.220.78.44 - 2022-12-07 07:43:01
37.220.78.47 - 2023-03-04 02:21:22
37.220.78.72 - 2022-12-07 07:43:01
37.220.78.108 - 2021-09-15 11:11:16
37.220.78.123 - 2023-02-07 12:47:52
37.220.78.143 - 2023-09-12 08:22:05
37.220.78.154 - 2022-01-24 02:19:41
37.220.78.165 - 2021-05-02 03:02:49
37.220.78.181 - 2022-01-27 02:19:23
37.220.78.186 - 2023-03-14 10:09:35
37.220.78.208 - 2022-12-07 07:43:01
37.220.78.210 - 2023-01-28 19:17:02
37.220.78.212 - 2021-11-29 19:15:32
37.220.78.227 - 2022-04-30 04:04:30
37.220.78.235 - 2022-06-01 05:04:56
37.220.78.243 - 2021-03-07 15:24:42
37.220.78.255 - 2023-08-25 18:04:25


ISP:iPKO Telecommunications LLC
https://www.abuseipdb.com/check-block/46.99.144.0/24

46.99.144.11 - 2021-03-28 21:20:01
46.99.144.15 - 2022-07-23 03:53:31
46.99.144.22 - 2020-11-30 08:56:04
46.99.144.37 - 2021-08-26 01:00:02
46.99.144.43 - 2023-09-19 13:01:56
46.99.144.47 - 2021-03-30 03:39:17
46.99.144.52 - 2021-11-05 10:41:51
46.99.144.54 - 2021-04-10 20:03:20
46.99.144.55 - 2021-08:17 07:13:57
46.99.144.56 - 2020-11-27 06:48:56
46.99.144.67 - 2021-02-17 02:39:13
46.99.144.68 - 2021-09-30 06:06:18
46.99.144.69 - 2020-11-25 18:14:58
46.99.144.70 - 2021-09-14 20:41:28
46.99.144.75 - 2020-12:15 03:11:56
46.99.144.83 - 2021-08-07 20:46:22
46.99.144.84 - 2021-06:23 03:39:21
46.99.144.87 - 2021-02:26 17:08:27
46.99.144.91 - 2020-11:22 17:06:56
46.99.144.100 - 2020-11:30 10:45:39
46.99.144.101 - 2022-09:12 11:14:01
46.99.144.113 - 2023-06:13 15:19:53
46.99.144.116 - 2022-07:03 16:39:33
46.99.144.118 - 2020-12:16 16:55:06
46.99.144.121 - 2021-08:08 20:52:44
46.99.144.126 - 2021-08:08 11:04:18
46.99.144.154 - 2021-06:01 22:11:57
46.99.144.156 - 2021-10:22 06:35:14
46.99.144.196 - 2023-10-29 23:47:15
46.99.144.227 - 2023-10-29 23:47:39
46.99.144.246 - 2021-05:30 13:39:10
46.99.144.249 - 2020-12:22 14:05:30

ISP:Abakus Backa Palanka
https://www.abuseipdb.com/check-block/46.17.127.0/24

46.17.127.2 - 2023-03-27 02:26:12
46.17.127.3 - 2022-06-22 14:10:35
46.17.127.4 - 2021-07-13 21:09:34
46.17.127.6 - 2023-07-21 13:49:33
46.17.127.7 - 2023-08-22 17:00:27
46.17.127.11 - 2023-09-15 22:00:30
46.17.127.41 - 2023-04-15 13:03:30
46.17.127.60 - 2021-09-29 18:09:35
46.17.127.66 - 2023-09-01 22:21:56
46.17.127.90 - 2023-04-07 17:11:53
46.17.127.117 - 2023-10-22 18:59:46
46.17.127.119 - 2023-03-25 01:48:16
46.17.127.170 - 2021-04-01 05:57:16
46.17.127.218 - 2021-07-27 23:19:21
46.17.127.220 - 2023-06-27 08:43:01


ISP:M247 Europe SRL
https://www.abuseipdb.com/check-block/152.89.160.0/24

152.89.160.42 - 2023-03-29 04:27:22
152.89.160.50 - 2023-09-23 10:52:34
152.89.160.60 - 2022-05-10 18:00:19
152.89.160.62 - 2022-05-11 01:00:09
152.89.160.98 - 2023-08-23 23:04:20
152.89.160.99 - 2023-10-17 17:56:07
152.89.160.100 - 2023-10-30 01:38:28
152.89.160.101 - 2023-10-16 04:53:28
152.89.160.102 - 2023-08:11 00:05:11
152.89.160.103 - 2023-10-04 10:15:08
152.89.160.104 - 2022-12-31 13:19:54
152.89.160.105 - 2023-09-16 10:53:09
152.89.160.106 - 2023-10-01 11:13:21
152.89.160.107 - 2023-10-05 18:52:48
152.89.160.108 - 2023-09-26 11:19:12
152.89.160.109 - 2023-06-08 18:22:05
152.89.160.115 - 2023-09-15 00:26:21
152.89.160.116 - 2022-06-15 03:22:08
152.89.160.118 - 2022-05-11 21:21:36
152.89.160.131 - 2023-10-28 07:42:45
152.89.160.142 - 2023-01-27 00:54:20
152.89.160.148 - 2022-05-30 01:30:12
152.89.160.150 - 2022-05-26 18:50:50
152.89.160.180 - 2022-06-12 15:12:48
152.89.160.182 - 2022-06-12 16:34:42
152.89.160.183 - 2023-02-07 13:43:20
152.89.160.184 - 2023-02-20 13:59:56
152.89.160.185 - 2023-01-06 03:15:07
152.89.160.186 - 2022-02-26 22:16:45
152.89.160.187 - 2022-12-19 18:13:41
152.89.160.188 - 2022-12-13 06:02:31
152.89.160.189 - 2023-01-04 10:13:15
152.89.160.190 - 2021-10-24 19:00:10
152.89.160.211 - 2021-06-08 07:12:30
152.89.160.212 - 2022-05-07 16:24:56
152.89.160.214 - 2022-04-22 15:15:58
152.89.160.216 - 2021-04-01 14:16:36
152.89.160.242 - 2023-09-30 06:30:53
152.89.160.245 - 2022-09-15 17:22:54
152.89.160.253 - 2022-03-22 13:05:40]]> <![CDATA[CyberBalkans HoneyPot @balkanssec]]> https://bezbedanbalkan.net/thread-592.html Wed, 05 Apr 2023 12:45:55 +0000 1van]]> https://bezbedanbalkan.net/thread-592.html @balkanssec (dok nam se ne pridruži ili dok ne automatizujemo importovanje sa remote izvora).

P.S. Dosta toga je već detektovano i na našim HoneyPots ali dok ne napravimo automatizaciju nije na odmet i da ostavljamo ovde ručno rezultate i sa drugih izvora.]]> @balkanssec (dok nam se ne pridruži ili dok ne automatizujemo importovanje sa remote izvora).

P.S. Dosta toga je već detektovano i na našim HoneyPots ali dok ne napravimo automatizaciju nije na odmet i da ostavljamo ovde ručno rezultate i sa drugih izvora.]]> <![CDATA[Detektovani napadi iz domaceg saobracaja (Bezbedan Balkan Honeypots)]]> https://bezbedanbalkan.net/thread-572.html Sat, 25 Mar 2023 23:17:07 +0000 Petar]]> https://bezbedanbalkan.net/thread-572.html
Schneider Electric DMS NS LLC Novi Sad (AS 198273)
        IP                      br napada
    91.233.24.128      1
    91.233.24.201      1
    91.233.24.250      1
    91.233.24.6          1
    91.233.24.79        1
   
Drustvo za telekomunikacije Orion telekom doo Beograd, Gandijeva 76a (AS 9125)
        IP                      br napada
    77.105.29.203      3149
    77.105.51.100      443
    77.105.51.239      88
    188.255.172.54    1
    77.105.63.124      1
   
    Suricata IDS detekcije:
    ET MALWARE Possible Linux.Mirai Login Attempt (888888)  - 12 (broj detekcija)
    ET MALWARE Possible Linux.Mirai Login Attempt (666666)  - 9 (broj detekcija)
    ET MALWARE Possible Linux.Mirai Login Attempt (service) - 8 (broj detekcija)
    ET MALWARE Possible Linux.Mirai Login Attempt (ubnt) - 8 (breoj detekcija)
    ET MALWARE Possible Linux.Mirai Login Attempt (7ujMko0admin) - 7 (breoj detekcija)
    ET MALWARE Possible Linux.Mirai Login Attempt (54321) - 5 (breoj detekcija)
   
Vip mobile d.o.o. (AS 44143)
        IP                     broj napada
    77.243.24.147      13

TELEKOM SRBIJA a.d. (AS 8400)
        IP                      broj napada
    109.93.109.67      1
    109.93.131.71      1
    109.93.202.49      1
    178.220.205.42    1
    178.221.199.107  1
    79.101.186.82      1
    91.150.75.47        1
    93.86.194.53        1
    93.87.128.125      1
    93.87.186.88        1

Serbia BroadBand-Srpske Kablovske mreze d.o.o. (AS 31042)
        IP                       broj napada
    178.149.255.21     1
    24.135.126.92       1
    24.135.192.86       1
    46.240.239.30       1
    94.189.153.27       1
    94.189.209.78       1
   
Akademska mreza Republike Srbije - AMRES (AS 13092)
        IP                        broj napada
    147.91.193.123      1
    147.91.229.126      1
    147.91.86.125        1
   
Jotel d.o.o. (AS 197423)
        IP                        broj napada
    109.106.229.165    2
   
YUnet International d.o.o. (AS 8771)
        IP                          broj napada
    213.240.38.62          1
   
Invitech ICT Services Kft. (AS 12301)
        IP                      broj napada
    185.31.33.94        1
   
University of Nis (AS 13303)
        IP                      broj napda
    160.99.125.69      1]]>
Schneider Electric DMS NS LLC Novi Sad (AS 198273)
        IP                      br napada
    91.233.24.128      1
    91.233.24.201      1
    91.233.24.250      1
    91.233.24.6          1
    91.233.24.79        1
   
Drustvo za telekomunikacije Orion telekom doo Beograd, Gandijeva 76a (AS 9125)
        IP                      br napada
    77.105.29.203      3149
    77.105.51.100      443
    77.105.51.239      88
    188.255.172.54    1
    77.105.63.124      1
   
    Suricata IDS detekcije:
    ET MALWARE Possible Linux.Mirai Login Attempt (888888)  - 12 (broj detekcija)
    ET MALWARE Possible Linux.Mirai Login Attempt (666666)  - 9 (broj detekcija)
    ET MALWARE Possible Linux.Mirai Login Attempt (service) - 8 (broj detekcija)
    ET MALWARE Possible Linux.Mirai Login Attempt (ubnt) - 8 (breoj detekcija)
    ET MALWARE Possible Linux.Mirai Login Attempt (7ujMko0admin) - 7 (breoj detekcija)
    ET MALWARE Possible Linux.Mirai Login Attempt (54321) - 5 (breoj detekcija)
   
Vip mobile d.o.o. (AS 44143)
        IP                     broj napada
    77.243.24.147      13

TELEKOM SRBIJA a.d. (AS 8400)
        IP                      broj napada
    109.93.109.67      1
    109.93.131.71      1
    109.93.202.49      1
    178.220.205.42    1
    178.221.199.107  1
    79.101.186.82      1
    91.150.75.47        1
    93.86.194.53        1
    93.87.128.125      1
    93.87.186.88        1

Serbia BroadBand-Srpske Kablovske mreze d.o.o. (AS 31042)
        IP                       broj napada
    178.149.255.21     1
    24.135.126.92       1
    24.135.192.86       1
    46.240.239.30       1
    94.189.153.27       1
    94.189.209.78       1
   
Akademska mreza Republike Srbije - AMRES (AS 13092)
        IP                        broj napada
    147.91.193.123      1
    147.91.229.126      1
    147.91.86.125        1
   
Jotel d.o.o. (AS 197423)
        IP                        broj napada
    109.106.229.165    2
   
YUnet International d.o.o. (AS 8771)
        IP                          broj napada
    213.240.38.62          1
   
Invitech ICT Services Kft. (AS 12301)
        IP                      broj napada
    185.31.33.94        1
   
University of Nis (AS 13303)
        IP                      broj napda
    160.99.125.69      1]]> <![CDATA[Honeypot za balkanske IP adrese]]> https://bezbedanbalkan.net/thread-37.html Mon, 19 Sep 2022 07:50:56 +0000 y0d4]]> https://bezbedanbalkan.net/thread-37.html Konkretno, podigao bih honeypot na kom bi namesito da samo IP adrese sa balkana mogu da mu pristupe i time bi dobijali info na kojim IP adresama su zarazeni servisi i napadaci...
Sto posle mozemo i da automatizujemo da se salje email na abuse@ od IP adrese koja je ukljucena u malicioznu aktivnost...]]> Konkretno, podigao bih honeypot na kom bi namesito da samo IP adrese sa balkana mogu da mu pristupe i time bi dobijali info na kojim IP adresama su zarazeni servisi i napadaci...
Sto posle mozemo i da automatizujemo da se salje email na abuse@ od IP adrese koja je ukljucena u malicioznu aktivnost...]]>