mirror.dongdigua.github.io/weird_mglndd.html

278 lines
12 KiB
HTML
Raw Normal View History

2022-09-11 11:20:31 +08:00
<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
<head>
<!-- 2022-10-21 五 20:03 -->
2022-09-11 11:20:31 +08:00
<meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<title>Something About MGLNDD Scans</title>
<meta name="author" content="dongdigua" />
<meta name="generator" content="Org Mode" />
<style>
#content { max-width: 60em; margin: auto; }
.title { text-align: center;
margin-bottom: .2em; }
.subtitle { text-align: center;
font-size: medium;
font-weight: bold;
margin-top:0; }
.todo { font-family: monospace; color: red; }
.done { font-family: monospace; color: green; }
.priority { font-family: monospace; color: orange; }
.tag { background-color: #eee; font-family: monospace;
padding: 2px; font-size: 80%; font-weight: normal; }
.timestamp { color: #bebebe; }
.timestamp-kwd { color: #5f9ea0; }
.org-right { margin-left: auto; margin-right: 0px; text-align: right; }
.org-left { margin-left: 0px; margin-right: auto; text-align: left; }
.org-center { margin-left: auto; margin-right: auto; text-align: center; }
.underline { text-decoration: underline; }
#postamble p, #preamble p { font-size: 90%; margin: .2em; }
p.verse { margin-left: 3%; }
pre {
border: 1px solid #e6e6e6;
border-radius: 3px;
background-color: #f2f2f2;
padding: 8pt;
font-family: monospace;
overflow: auto;
margin: 1.2em;
}
pre.src {
position: relative;
overflow: auto;
}
pre.src:before {
display: none;
position: absolute;
top: -8px;
right: 12px;
padding: 3px;
color: #555;
background-color: #f2f2f299;
}
pre.src:hover:before { display: inline; margin-top: 14px;}
/* Languages per Org manual */
pre.src-asymptote:before { content: 'Asymptote'; }
pre.src-awk:before { content: 'Awk'; }
pre.src-authinfo::before { content: 'Authinfo'; }
pre.src-C:before { content: 'C'; }
/* pre.src-C++ doesn't work in CSS */
pre.src-clojure:before { content: 'Clojure'; }
pre.src-css:before { content: 'CSS'; }
pre.src-D:before { content: 'D'; }
pre.src-ditaa:before { content: 'ditaa'; }
pre.src-dot:before { content: 'Graphviz'; }
pre.src-calc:before { content: 'Emacs Calc'; }
pre.src-emacs-lisp:before { content: 'Emacs Lisp'; }
pre.src-fortran:before { content: 'Fortran'; }
pre.src-gnuplot:before { content: 'gnuplot'; }
pre.src-haskell:before { content: 'Haskell'; }
pre.src-hledger:before { content: 'hledger'; }
pre.src-java:before { content: 'Java'; }
pre.src-js:before { content: 'Javascript'; }
pre.src-latex:before { content: 'LaTeX'; }
pre.src-ledger:before { content: 'Ledger'; }
pre.src-lisp:before { content: 'Lisp'; }
pre.src-lilypond:before { content: 'Lilypond'; }
pre.src-lua:before { content: 'Lua'; }
pre.src-matlab:before { content: 'MATLAB'; }
pre.src-mscgen:before { content: 'Mscgen'; }
pre.src-ocaml:before { content: 'Objective Caml'; }
pre.src-octave:before { content: 'Octave'; }
pre.src-org:before { content: 'Org mode'; }
pre.src-oz:before { content: 'OZ'; }
pre.src-plantuml:before { content: 'Plantuml'; }
pre.src-processing:before { content: 'Processing.js'; }
pre.src-python:before { content: 'Python'; }
pre.src-R:before { content: 'R'; }
pre.src-ruby:before { content: 'Ruby'; }
pre.src-sass:before { content: 'Sass'; }
pre.src-scheme:before { content: 'Scheme'; }
pre.src-screen:before { content: 'Gnu Screen'; }
pre.src-sed:before { content: 'Sed'; }
pre.src-sh:before { content: 'shell'; }
pre.src-sql:before { content: 'SQL'; }
pre.src-sqlite:before { content: 'SQLite'; }
/* additional languages in org.el's org-babel-load-languages alist */
pre.src-forth:before { content: 'Forth'; }
pre.src-io:before { content: 'IO'; }
pre.src-J:before { content: 'J'; }
pre.src-makefile:before { content: 'Makefile'; }
pre.src-maxima:before { content: 'Maxima'; }
pre.src-perl:before { content: 'Perl'; }
pre.src-picolisp:before { content: 'Pico Lisp'; }
pre.src-scala:before { content: 'Scala'; }
pre.src-shell:before { content: 'Shell Script'; }
pre.src-ebnf2ps:before { content: 'ebfn2ps'; }
/* additional language identifiers per "defun org-babel-execute"
in ob-*.el */
pre.src-cpp:before { content: 'C++'; }
pre.src-abc:before { content: 'ABC'; }
pre.src-coq:before { content: 'Coq'; }
pre.src-groovy:before { content: 'Groovy'; }
/* additional language identifiers from org-babel-shell-names in
ob-shell.el: ob-shell is the only babel language using a lambda to put
the execution function name together. */
pre.src-bash:before { content: 'bash'; }
pre.src-csh:before { content: 'csh'; }
pre.src-ash:before { content: 'ash'; }
pre.src-dash:before { content: 'dash'; }
pre.src-ksh:before { content: 'ksh'; }
pre.src-mksh:before { content: 'mksh'; }
pre.src-posh:before { content: 'posh'; }
/* Additional Emacs modes also supported by the LaTeX listings package */
pre.src-ada:before { content: 'Ada'; }
pre.src-asm:before { content: 'Assembler'; }
pre.src-caml:before { content: 'Caml'; }
pre.src-delphi:before { content: 'Delphi'; }
pre.src-html:before { content: 'HTML'; }
pre.src-idl:before { content: 'IDL'; }
pre.src-mercury:before { content: 'Mercury'; }
pre.src-metapost:before { content: 'MetaPost'; }
pre.src-modula-2:before { content: 'Modula-2'; }
pre.src-pascal:before { content: 'Pascal'; }
pre.src-ps:before { content: 'PostScript'; }
pre.src-prolog:before { content: 'Prolog'; }
pre.src-simula:before { content: 'Simula'; }
pre.src-tcl:before { content: 'tcl'; }
pre.src-tex:before { content: 'TeX'; }
pre.src-plain-tex:before { content: 'Plain TeX'; }
pre.src-verilog:before { content: 'Verilog'; }
pre.src-vhdl:before { content: 'VHDL'; }
pre.src-xml:before { content: 'XML'; }
pre.src-nxml:before { content: 'XML'; }
/* add a generic configuration mode; LaTeX export needs an additional
(add-to-list 'org-latex-listings-langs '(conf " ")) in .emacs */
pre.src-conf:before { content: 'Configuration File'; }
table { border-collapse:collapse; }
caption.t-above { caption-side: top; }
caption.t-bottom { caption-side: bottom; }
td, th { vertical-align:top; }
th.org-right { text-align: center; }
th.org-left { text-align: center; }
th.org-center { text-align: center; }
td.org-right { text-align: right; }
td.org-left { text-align: left; }
td.org-center { text-align: center; }
dt { font-weight: bold; }
.footpara { display: inline; }
.footdef { margin-bottom: 1em; }
.figure { padding: 1em; }
.figure p { text-align: center; }
.equation-container {
display: table;
text-align: center;
width: 100%;
}
.equation {
vertical-align: middle;
}
.equation-label {
display: table-cell;
text-align: right;
vertical-align: middle;
}
.inlinetask {
padding: 10px;
border: 2px solid gray;
margin: 10px;
background: #ffffcc;
}
#org-div-home-and-up
{ text-align: right; font-size: 70%; white-space: nowrap; }
textarea { overflow-x: auto; }
.linenr { font-size: smaller }
.code-highlighted { background-color: #ffff00; }
.org-info-js_info-navigation { border-style: none; }
#org-info-js_console-label
{ font-size: 10px; font-weight: bold; white-space: nowrap; }
.org-info-js_search-highlight
{ background-color: #ffff00; color: #000000; font-weight: bold; }
.org-svg { width: 90%; }
</style>
2022-09-15 11:45:58 +08:00
<link rel='stylesheet' type='text/css' href='css/main.css' />
2022-09-11 11:20:31 +08:00
</head>
<body>
<div id="org-div-home-and-up">
<a accesskey="h" href="./../"> UP </a>
|
<a accesskey="H" href="https://dongdigua.github.io"> HOME </a>
</div><div id="content" class="content">
<h1 class="title">Something About MGLNDD Scans</h1>
<div class="outline-2">
<h2><span class="section-number-2">1.</span> <a href="https://stretchoid.com/">stretchoid opt-out</a></h2>
2022-09-11 11:20:31 +08:00
<div class="outline-text-2" id="text-1">
<p>
it's this domain's workers that COMSTANTLY scanning the WHOLE internet<br />
2022-09-11 11:20:31 +08:00
</p>
</div>
</div>
<div class="outline-2">
<h2><span class="section-number-2">2.</span> <a href="https://isc.sans.edu/diary/MGLNDD_%2A+Scans/28458">SANS internet storm center diary</a></h2>
2022-09-11 11:20:31 +08:00
<div class="outline-text-2" id="text-2">
<p>
about the scanner and IP range<br />
</p>
</div>
<div class="outline-3">
<h3><span class="section-number-3">2.1.</span> <a href="https://cybersafenv.org/2022/03/20/mglndd-scans-sun-mar-20th/">repost on cybersafenv</a></h3>
2022-09-11 11:20:31 +08:00
</div>
</div>
<div class="outline-2">
<h2><span class="section-number-2">3.</span> <a href="http://www.hackdig.com/04/hack-81133.htm">知名网络空间普查与网络测绘组织研究报告 第一期-组织名录篇</a></h2>
2022-09-11 11:20:31 +08:00
</div>
<div class="outline-2">
<h2><span class="section-number-2">4.</span> <a href="https://duanmofan.com/archives/librarymanagementsystem">【水蓝石】 近日图书馆出入人员信息逸事和小恶魔创造【持续更新】</a></h2>
<div class="outline-text-2" id="text-4">
<blockquote>
<p>
博客主评价有很多包括stretchoid.com的组织有的是把自己伪装成科研实验用数据并没有恶意有的是什么理由也不给只是不停地扫描全网的网站。<br />
其中也包括像密歇根大学,加州大学伯克利分校的访问信息。因为网络安全领域没有类似于“希波克拉底誓言”的东西,所以不能像医生一样信任<br />
就像到处晃别人家的门把手而不打开不是犯罪,但是真正的打开就混在发现没有锁门,而晃门把手时。<br />
</p>
</blockquote>
</div>
<div class="outline-4">
<h4><span class="section-number-4">4.0.1.</span> <a href="https://www.hackerfactor.com/blog/index.php?/archives/775-Scans-and-Attacks.html">HackerFactor: Scans &amp; Attacks</a></h4>
</div>
2022-09-11 11:20:31 +08:00
</div>
<div class="outline-2">
<h2><span class="section-number-2">5.</span> <a href="https://github.com/dongdigua/portscan-listener/blob/main/log/some_strange_logs.md">my listener and some other logs</a></h2>
<div class="outline-text-2" id="text-5">
</div>
<div class="outline-3">
<h3><span class="section-number-3">5.1.</span> <a href="https://www.bilibili.com/read/cv16357621">my post on bilibili</a></h3>
</div>
2022-09-11 11:20:31 +08:00
</div>
<div class="outline-2">
<h2><span class="section-number-2">6.</span> <a href="https://zhuanlan.zhihu.com/p/67186794">zhihu:repost-translation: 如何建立一个基本的蜜罐</a></h2>
2022-09-11 11:20:31 +08:00
<div class="outline-text-2" id="text-6">
<p>
the original post is gone<br />
</p>
<blockquote>
<p>
您还可以开始执行DNS和WHOIS查找以找出每次扫描背后的人员。<br />
在这个简短的样本中我找到了一个伪“研究员”107.170.202.111解析为“zg-0301f-15.stretchoid.com”。<br />
他们没有确定他们正在做什么或为什么他们在161 / udp扫描我的蜜罐。端口161 / udp是为简单的网络管理协议SNMP保留的并且经常容易受到攻击。<br />
2022-09-11 11:20:31 +08:00
是的他们把“malicious”拼错了 - 因此它可能不会出现在谷歌搜索“stretchoid and malicious”的结果中。<br />
</p>
</blockquote>
</div>
</div>
<div class="outline-2">
<h2><span class="section-number-2">7.</span> <a href="https://www.digitalocean.com/community/questions/why-is-digital-ocean-showing-in-my-router-connecting-to-a-ps4">Why is Digital Ocean showing in my router, connecting to a PS4?</a></h2>
2022-09-11 11:20:31 +08:00
</div>
</div>
<div id="postamble" class="status">
2022-09-15 17:18:00 +08:00
<p class="date">Date: 2022-08-17 三 00:00</p>
2022-09-11 11:20:31 +08:00
<p class="author">Author: dongdigua</p>
<p class="date">Created: 2022-10-21 五 20:03</p>
2022-09-11 11:20:31 +08:00
</div>
</body>
</html>