The information contained on this page and linked documents contain information from various VoIP based honeypots I have on the Internet. The difference between the
information you will here and the information seen on the bruteforcing page is; these are the addresses that have managed to obtain an account on a honeypot.
They have moved beyond bruteforcing and believe they can dial numbers when in reality, they go nowhere. The information listed here has the honeypot information sanitized
as to continue to obtain information on attackers. I will attempt to place as much information as I can about the attacker including the numbers they attempt to dial, the
provider they're coming in on, and the SIPURI's used.
Hopefully someone would have more time than I have in correlating, studying and or reporting data. Be advised, the typical attack canvas has changed from my perspective.
What I see with regards to VoIP attacks is the following:
Attacker --> Launch a Brute Force --> PBX
Attacker --> Account found? --> If so...
Attacker Using A Different IP --> Register with that information.
For example:
Suppose there is an active attack from 10.10.10.2 that leverages account 100. You will not see 10.10.10.2 register to 100. In fact, if you wait around for a while you
will see another host from another netblock register an account.
Prior to 2010 when I would see attacks occur, when an account was leveraged, an attacker would immediately fire off thousands of calls. Not anymore. The trend that I have
seen all of this year has been something similar to the following using information obtained from actual attempted calls:
9938972673399 - SIP/REMOVED
0138972673399 - SIP/REMOVED
110138972673399 - SIP/REMOVED
Notice the trend?
For those wondering how I gather data, I created and placed a couple of honeypots on the net to gather data. If you're wondering, yes I also have the IP Addresses for
RFC1918 hosts. Anyhow, for the month of September here is data from 3 of 28 honeypots I have churning. No need for me to post from all hosts I use. Hostid is a hash of my
PBX in case someone is wondering.
Who the hell cares about this?
With the trends I'm noticing, I'm willing to bet that the first number dialed such as the instance listed above, is under some form of control by the
attacker. Because of the timing variables involved, there is intervention when inserting 01, 011, 99, 66 in front of the same number (38972673399). My theory is, an
attacker gained an account and prior to firing off thousands of calls, they're checking to see which work and which don't and how/if they can get it to work. The issue
is, how the hell can they know someone is NOT on the other line? My honeypot acts as if it's calling a phone and goes to an unmarked voicemail. Which means, they likely
expected SOMETHING to answer, it DIDN'T and they're manipulating the digits to get it to work. Make sense?
Anyhow, for those who've been kind enough to collaborate with me, give me pointers, etc., feel free to contact me about this project and the data obtained from it. It may
do operators, investigators good to know what numbers attackers are calling, where they're actually coming from, etc.. Correspondence will be kept in the strictest
confidence and anyone enquiring will be vetted so please prepare for 1k questions if I'm not familiar with you or your company or someone you know. (Believe me, there has
to be someone I know, I'm a PITA like that, I thought you knew).
For those running Asterisk based systems, if you're interested in running a honeypot, let me know and again, depending on who you are, I will pass over my program to get
it running, etc.
mysql> use arkeos ;
Database changed
mysql> select * from bruteforcers where start_date like '%2010-09%';
+------------------------------------------+------------+------------+------------+-----------+-----------------+----------+
| hostid | start_date | start_time | stop_date | stop_time | attacker | attempts |
+------------------------------------------+------------+------------+------------+-----------+-----------------+----------+
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-01 | 18:42:15 | 2010-09-01 | 18:56:37 | 208.109.86.239 | 44077 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-01 | 18:48:13 | 2010-09-01 | 18:48:13 | 74.95.180.185 | 1 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-01 | 19:43:21 | 2010-09-01 | 20:45:18 | 141.223.41.2 | 125754 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-02 | 08:32:55 | 2010-09-02 | 23:56:55 | 71.174.103.42 | 1232 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-03 | 00:00:29 | 2010-09-03 | 12:31:27 | 71.174.103.42 | 1003 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-03 | 05:19:27 | 2010-09-03 | 05:27:50 | 208.113.57.1 | 39489 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-03 | 22:30:29 | 2010-09-03 | 23:03:20 | 59.108.67.134 | 67854 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-04 | 04:02:46 | 2010-09-04 | 04:35:54 | 59.125.36.68 | 45832 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-04 | 20:29:58 | 2010-09-04 | 20:33:47 | 66.230.184.106 | 577 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-05 | 03:38:02 | 2010-09-05 | 04:08:12 | 65.127.120.168 | 64010 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-05 | 11:12:13 | 2010-09-05 | 11:15:08 | 221.221.177.13 | 2323 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-05 | 11:12:13 | 2010-09-05 | 11:15:13 | 221.221.179.112 | 2230 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-05 | 19:57:39 | 2010-09-05 | 20:04:01 | 174.36.15.19 | 39117 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-06 | 19:20:42 | 2010-09-06 | 19:21:11 | 211.44.183.72 | 4102 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-07 | 16:55:46 | 2010-09-07 | 16:56:38 | 208.51.101.201 | 2 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-08 | 09:20:31 | 2010-09-08 | 10:05:14 | 208.51.101.201 | 60 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-08 | 21:33:49 | 2010-09-08 | 21:43:15 | 221.236.12.33 | 42362 |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-09 | 03:50:16 | 2010-09-09 | 03:53:04 | 193.239.124.54 | 4053 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-09 | 03:48:23 | 2010-09-09 | 05:23:46 | 193.239.124.54 | 95722 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-09 | 03:48:23 | 2010-09-09 | 05:23:46 | 193.239.124.54 | 47861 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-09 | 03:48:23 | 2010-09-09 | 05:23:46 | 193.239.124.54 | 47861 |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-09 | 03:50:16 | 2010-09-09 | 03:53:04 | 193.239.124.54 | 4053 |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-09 | 18:02:12 | 2010-09-09 | 18:12:47 | 147.83.20.101 | 14894 |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-09 | 21:42:18 | 2010-09-09 | 21:42:51 | 208.86.252.15 | 3992 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-09 | 03:48:23 | 2010-09-09 | 05:23:46 | 193.239.124.54 | 143583 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-09 | 03:48:23 | 2010-09-09 | 05:23:46 | 193.239.124.54 | 47861 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-09 | 03:48:23 | 2010-09-09 | 05:23:46 | 193.239.124.54 | 95722 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-09 | 18:00:15 | 2010-09-09 | 18:05:53 | 147.83.20.101 | 14742 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-09 | 21:40:26 | 2010-09-09 | 23:11:21 | 208.86.252.15 | 165268 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 15211 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 15211 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 30422 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 45633 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 60844 |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-10 | 16:02:47 | 2010-09-10 | 16:03:39 | 208.3.90.122 | 286 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 15211 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 30422 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 45633 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 60844 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 76055 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55 | 2010-09-10 | 16:17:42 | 208.3.90.122 | 91266 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 13:56:58 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 13:56:58 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 13:56:58 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 13:56:58 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 13:56:58 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 13:56:58 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 13:56:58 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 13:56:58 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 2010-09-12 | 20:57:03 | 208.43.80.149 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 13:56:58 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 2010-09-12 | 20:57:03 | 208.43.80.149 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 2010-09-12 | 21:57:03 | 208.43.80.149 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 13:56:58 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 19658 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 31997 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 44336 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 56675 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 69014 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 7319 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 81353 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 0000-00-00 | 00:00:00 | 208.180.144.252 | |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 2010-09-12 | 20:57:03 | 208.43.80.149 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 2010-09-12 | 21:57:03 | 208.43.80.149 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 2010-09-12 | 22:57:03 | 208.43.80.149 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 2010-09-12 | 22:57:03 | 208.43.80.149 | 44336 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 2010-09-12 | 23:46:13 | 208.43.80.149 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 2010-09-12 | 23:46:13 | 208.43.80.149 | 69014 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 0000-00-00 | 00:00:00 | 208.43.80.149 | |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 13:56:58 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 19658 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 31997 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 44336 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 56675 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 69014 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 7319 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37 | 2010-09-12 | 14:20:06 | 208.180.144.252 | 81353 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 2010-09-12 | 20:57:03 | 208.43.80.149 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 2010-09-12 | 21:57:03 | 208.43.80.149 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 2010-09-12 | 22:57:03 | 208.43.80.149 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 2010-09-12 | 22:57:03 | 208.43.80.149 | 44336 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 2010-09-12 | 23:46:13 | 208.43.80.149 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 2010-09-12 | 23:46:13 | 208.43.80.149 | 69014 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57 | 2010-09-12 | 23:46:13 | 208.43.80.149 | 81353 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-13 | 22:26:30 | 2010-09-13 | 22:56:58 | 140.113.39.212 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-13 | 22:26:30 | 2010-09-13 | 22:56:58 | 140.113.39.212 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-14 | 20:07:08 | 2010-09-14 | 20:37:07 | 208.109.90.31 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-14 | 20:07:08 | 0000-00-00 | 00:00:00 | 208.109.90.31 | |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-14 | 20:07:08 | 2010-09-14 | 20:37:07 | 208.109.90.31 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-14 | 20:07:08 | 2010-09-14 | 20:37:07 | 208.109.90.31 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-14 | 20:07:08 | 2010-09-14 | 20:37:07 | 208.109.90.31 | 0 |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-15 | 10:14:52 | 2010-09-15 | 10:55:33 | 64.71.155.117 | 0 |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-17 | 07:55:17 | 2010-09-17 | 08:12:46 | 174.129.0.133 | 0 |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-17 | 07:55:17 | 2010-09-17 | 08:12:46 | 174.129.0.133 | 304 |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-17 | 20:42:18 | 2010-09-17 | 20:42:21 | 220.90.137.98 | 23378 |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-19 | 16:54:38 | 2010-09-19 | 16:56:56 | 58.26.44.66 | 0 |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-19 | 17:41:11 | 2010-09-19 | 18:03:52 | 66.197.184.60 | 0 |
+------------------------------------------+------------+------------+------------+-----------+-----------------+----------+
115 rows in set, 1 warning (0.01 sec)
mysql> select * from attackers where start_date like '%2010-09%';
+------------------------------------------+----------------+------------------+-----------------------------------+--------------+------------+------------+
| hostname | extension_used | attacker_address | user_agent | channel_used | start_date | start_time |
+------------------------------------------+----------------+------------------+-----------------------------------+--------------+------------+------------+
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094 | 192.168.0.124 | SIPPER for PhonerLite | 2094 | 2010-09-10 | 00:22:23 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094 | 192.168.0.124 | SIPPER for PhonerLite | 2094 | 2010-09-10 | 00:22:30 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094 | 192.168.0.124 | SIPPER for PhonerLite | 2094 | 2010-09-10 | 00:24:45 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094 | 192.168.0.124 | SIPPER for PhonerLite | 2094 | 2010-09-10 | 00:29:00 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094 | 192.168.0.124 | SIPPER for PhonerLite | 2094 | 2010-09-10 | 00:29:07 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094 | 192.168.0.124 | SIPPER for PhonerLite | 2094 | 2010-09-10 | 00:29:50 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094 | 192.168.0.124 | SIPPER for PhonerLite | 2094 | 2010-09-10 | 00:29:54 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094 | 192.168.0.124 | SIPPER for PhonerLite | 2094 | 2010-09-10 | 00:30:30 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094 | 192.168.0.124 | SIPPER for PhonerLite | 2094 | 2010-09-10 | 00:30:39 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2095 | 192.168.1.253 | VaxSIPUserAgent/3.0 | 2095 | 2010-09-10 | 14:48:06 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2095 | 192.168.1.253 | VaxSIPUserAgent/3.0 | 2095 | 2010-09-10 | 14:48:57 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2095 | 192.168.1.253 | VaxSIPUserAgent/3.0 | 2095 | 2010-09-10 | 14:49:11 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2095 | 192.168.1.253 | VaxSIPUserAgent/3.0 | 2095 | 2010-09-10 | 14:49:36 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094 | 192.168.0.99 | SIPPER for PhonerLite | 2094 | 2010-09-10 | 23:46:18 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094 | 192.168.0.99 | SIPPER for PhonerLite | 2094 | 2010-09-10 | 23:46:50 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 1022 | 92.81.245.67 | Zoiper rev.5324 | 1022 | 2010-09-11 | 03:16:28 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 1022 | 192.168.1.253 | VaxSIPUserAgent/3.0 | 1022 | 2010-09-14 | 16:27:14 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 1022 | 192.168.1.253 | VaxSIPUserAgent/3.0 | 1022 | 2010-09-14 | 16:27:17 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 1022 | 192.168.1.253 | VaxSIPUserAgent/3.0 | 1022 | 2010-09-14 | 16:27:42 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2097 | 151.53.90.159 | 2097 | 2010-09-21 | 2010-09-22 | 00:20:10 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094 | 192.168.1.4 | eyeBeam release 3006o stamp 17551 | 2094 | 2010-09-21 | 10:11:17 |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094 | 192.168.1.4 | eyeBeam release 3006o stamp 17551 | 2094 | 2010-09-21 | 10:11:56 |
+------------------------------------------+----------------+------------------+-----------------------------------+--------------+------------+------------+
22 rows in set, 1 warning (0.01 sec)
|
