Arkeos Honeypot Project

The information contained on this page and linked documents contain information from various VoIP based honeypots I have on the Internet. The difference between the information you will here and the information seen on the bruteforcing page is; these are the addresses that have managed to obtain an account on a honeypot.

They have moved beyond bruteforcing and believe they can dial numbers when in reality, they go nowhere. The information listed here has the honeypot information sanitized as to continue to obtain information on attackers. I will attempt to place as much information as I can about the attacker including the numbers they attempt to dial, the provider they're coming in on, and the SIPURI's used.

Hopefully someone would have more time than I have in correlating, studying and or reporting data. Be advised, the typical attack canvas has changed from my perspective. What I see with regards to VoIP attacks is the following:

Attacker --> Launch a Brute Force --> PBX
Attacker --> Account found? --> If so...
Attacker Using A Different IP --> Register with that information.


For example:

Suppose there is an active attack from 10.10.10.2 that leverages account 100. You will not see 10.10.10.2 register to 100. In fact, if you wait around for a while you will see another host from another netblock register an account. Prior to 2010 when I would see attacks occur, when an account was leveraged, an attacker would immediately fire off thousands of calls. Not anymore. The trend that I have seen all of this year has been something similar to the following using information obtained from actual attempted calls:

9938972673399 - SIP/REMOVED
0138972673399 - SIP/REMOVED
110138972673399 - SIP/REMOVED

Notice the trend?

For those wondering how I gather data, I created and placed a couple of honeypots on the net to gather data. If you're wondering, yes I also have the IP Addresses for RFC1918 hosts. Anyhow, for the month of September here is data from 3 of 28 honeypots I have churning. No need for me to post from all hosts I use. Hostid is a hash of my PBX in case someone is wondering.

Who the hell cares about this?

With the trends I'm noticing, I'm willing to bet that the first number dialed such as the instance listed above, is under some form of control by the attacker. Because of the timing variables involved, there is intervention when inserting 01, 011, 99, 66 in front of the same number (38972673399). My theory is, an attacker gained an account and prior to firing off thousands of calls, they're checking to see which work and which don't and how/if they can get it to work. The issue is, how the hell can they know someone is NOT on the other line? My honeypot acts as if it's calling a phone and goes to an unmarked voicemail. Which means, they likely expected SOMETHING to answer, it DIDN'T and they're manipulating the digits to get it to work. Make sense?

Anyhow, for those who've been kind enough to collaborate with me, give me pointers, etc., feel free to contact me about this project and the data obtained from it. It may do operators, investigators good to know what numbers attackers are calling, where they're actually coming from, etc.. Correspondence will be kept in the strictest confidence and anyone enquiring will be vetted so please prepare for 1k questions if I'm not familiar with you or your company or someone you know. (Believe me, there has to be someone I know, I'm a PITA like that, I thought you knew).

For those running Asterisk based systems, if you're interested in running a honeypot, let me know and again, depending on who you are, I will pass over my program to get it running, etc.


mysql> use arkeos ;
Database changed

mysql> select * from bruteforcers where start_date like '%2010-09%';
+------------------------------------------+------------+------------+------------+-----------+-----------------+----------+
| hostid                                   | start_date | start_time | stop_date  | stop_time | attacker        | attempts |
+------------------------------------------+------------+------------+------------+-----------+-----------------+----------+
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-01 | 18:42:15   | 2010-09-01 | 18:56:37  | 208.109.86.239  | 44077    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-01 | 18:48:13   | 2010-09-01 | 18:48:13  | 74.95.180.185   | 1        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-01 | 19:43:21   | 2010-09-01 | 20:45:18  | 141.223.41.2    | 125754   |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-02 | 08:32:55   | 2010-09-02 | 23:56:55  | 71.174.103.42   | 1232     |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-03 | 00:00:29   | 2010-09-03 | 12:31:27  | 71.174.103.42   | 1003     |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-03 | 05:19:27   | 2010-09-03 | 05:27:50  | 208.113.57.1    | 39489    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-03 | 22:30:29   | 2010-09-03 | 23:03:20  | 59.108.67.134   | 67854    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-04 | 04:02:46   | 2010-09-04 | 04:35:54  | 59.125.36.68    | 45832    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-04 | 20:29:58   | 2010-09-04 | 20:33:47  | 66.230.184.106  | 577      |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-05 | 03:38:02   | 2010-09-05 | 04:08:12  | 65.127.120.168  | 64010    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-05 | 11:12:13   | 2010-09-05 | 11:15:08  | 221.221.177.13  | 2323     |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-05 | 11:12:13   | 2010-09-05 | 11:15:13  | 221.221.179.112 | 2230     |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-05 | 19:57:39   | 2010-09-05 | 20:04:01  | 174.36.15.19    | 39117    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-06 | 19:20:42   | 2010-09-06 | 19:21:11  | 211.44.183.72   | 4102     |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-07 | 16:55:46   | 2010-09-07 | 16:56:38  | 208.51.101.201  | 2        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-08 | 09:20:31   | 2010-09-08 | 10:05:14  | 208.51.101.201  | 60       |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-08 | 21:33:49   | 2010-09-08 | 21:43:15  | 221.236.12.33   | 42362    |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-09 | 03:50:16   | 2010-09-09 | 03:53:04  | 193.239.124.54  | 4053     |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-09 | 03:48:23   | 2010-09-09 | 05:23:46  | 193.239.124.54  | 95722    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-09 | 03:48:23   | 2010-09-09 | 05:23:46  | 193.239.124.54  | 47861    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-09 | 03:48:23   | 2010-09-09 | 05:23:46  | 193.239.124.54  | 47861    |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-09 | 03:50:16   | 2010-09-09 | 03:53:04  | 193.239.124.54  | 4053     |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-09 | 18:02:12   | 2010-09-09 | 18:12:47  | 147.83.20.101   | 14894    |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-09 | 21:42:18   | 2010-09-09 | 21:42:51  | 208.86.252.15   | 3992     |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-09 | 03:48:23   | 2010-09-09 | 05:23:46  | 193.239.124.54  | 143583   |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-09 | 03:48:23   | 2010-09-09 | 05:23:46  | 193.239.124.54  | 47861    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-09 | 03:48:23   | 2010-09-09 | 05:23:46  | 193.239.124.54  | 95722    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-09 | 18:00:15   | 2010-09-09 | 18:05:53  | 147.83.20.101   | 14742    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-09 | 21:40:26   | 2010-09-09 | 23:11:21  | 208.86.252.15   | 165268   |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 15211    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 15211    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 30422    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 45633    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 60844    |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-10 | 16:02:47   | 2010-09-10 | 16:03:39  | 208.3.90.122    | 286      |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 15211    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 30422    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 45633    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 60844    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 76055    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-10 | 16:00:55   | 2010-09-10 | 16:17:42  | 208.3.90.122    | 91266    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 13:56:58  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 13:56:58  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 13:56:58  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 13:56:58  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 13:56:58  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 13:56:58  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 13:56:58  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 13:56:58  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 2010-09-12 | 20:57:03  | 208.43.80.149   | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 13:56:58  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 2010-09-12 | 20:57:03  | 208.43.80.149   | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 2010-09-12 | 21:57:03  | 208.43.80.149   | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 13:56:58  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 19658    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 31997    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 44336    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 56675    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 69014    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 7319     |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 81353    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 0000-00-00 | 00:00:00  | 208.180.144.252 |          |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 2010-09-12 | 20:57:03  | 208.43.80.149   | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 2010-09-12 | 21:57:03  | 208.43.80.149   | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 2010-09-12 | 22:57:03  | 208.43.80.149   | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 2010-09-12 | 22:57:03  | 208.43.80.149   | 44336    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 2010-09-12 | 23:46:13  | 208.43.80.149   | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 2010-09-12 | 23:46:13  | 208.43.80.149   | 69014    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 0000-00-00 | 00:00:00  | 208.43.80.149   |          |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 13:56:58  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 19658    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 31997    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 44336    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 56675    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 69014    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 7319     |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 13:33:37   | 2010-09-12 | 14:20:06  | 208.180.144.252 | 81353    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 2010-09-12 | 20:57:03  | 208.43.80.149   | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 2010-09-12 | 21:57:03  | 208.43.80.149   | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 2010-09-12 | 22:57:03  | 208.43.80.149   | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 2010-09-12 | 22:57:03  | 208.43.80.149   | 44336    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 2010-09-12 | 23:46:13  | 208.43.80.149   | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 2010-09-12 | 23:46:13  | 208.43.80.149   | 69014    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-12 | 20:54:57   | 2010-09-12 | 23:46:13  | 208.43.80.149   | 81353    |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-13 | 22:26:30   | 2010-09-13 | 22:56:58  | 140.113.39.212  | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-13 | 22:26:30   | 2010-09-13 | 22:56:58  | 140.113.39.212  | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-14 | 20:07:08   | 2010-09-14 | 20:37:07  | 208.109.90.31   | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-14 | 20:07:08   | 0000-00-00 | 00:00:00  | 208.109.90.31   |          |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-14 | 20:07:08   | 2010-09-14 | 20:37:07  | 208.109.90.31   | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-14 | 20:07:08   | 2010-09-14 | 20:37:07  | 208.109.90.31   | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-14 | 20:07:08   | 2010-09-14 | 20:37:07  | 208.109.90.31   | 0        |
| e3d8862a1f1457b8722646dbec79d0f4b7e1b2ab | 2010-09-15 | 10:14:52   | 2010-09-15 | 10:55:33  | 64.71.155.117   | 0        |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-17 | 07:55:17   | 2010-09-17 | 08:12:46  | 174.129.0.133   | 0        |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-17 | 07:55:17   | 2010-09-17 | 08:12:46  | 174.129.0.133   | 304      |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-17 | 20:42:18   | 2010-09-17 | 20:42:21  | 220.90.137.98   | 23378    |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-19 | 16:54:38   | 2010-09-19 | 16:56:56  | 58.26.44.66     | 0        |
| beb54038031a6d92427f98fece8d00dd41743aee | 2010-09-19 | 17:41:11   | 2010-09-19 | 18:03:52  | 66.197.184.60   | 0        |
+------------------------------------------+------------+------------+------------+-----------+-----------------+----------+
115 rows in set, 1 warning (0.01 sec)

mysql> select * from attackers where start_date like '%2010-09%';
+------------------------------------------+----------------+------------------+-----------------------------------+--------------+------------+------------+
| hostname                                 | extension_used | attacker_address | user_agent                        | channel_used | start_date | start_time |
+------------------------------------------+----------------+------------------+-----------------------------------+--------------+------------+------------+
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094           | 192.168.0.124    | SIPPER for PhonerLite             | 2094         | 2010-09-10 | 00:22:23   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094           | 192.168.0.124    | SIPPER for PhonerLite             | 2094         | 2010-09-10 | 00:22:30   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094           | 192.168.0.124    | SIPPER for PhonerLite             | 2094         | 2010-09-10 | 00:24:45   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094           | 192.168.0.124    | SIPPER for PhonerLite             | 2094         | 2010-09-10 | 00:29:00   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094           | 192.168.0.124    | SIPPER for PhonerLite             | 2094         | 2010-09-10 | 00:29:07   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094           | 192.168.0.124    | SIPPER for PhonerLite             | 2094         | 2010-09-10 | 00:29:50   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094           | 192.168.0.124    | SIPPER for PhonerLite             | 2094         | 2010-09-10 | 00:29:54   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094           | 192.168.0.124    | SIPPER for PhonerLite             | 2094         | 2010-09-10 | 00:30:30   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094           | 192.168.0.124    | SIPPER for PhonerLite             | 2094         | 2010-09-10 | 00:30:39   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2095           | 192.168.1.253    | VaxSIPUserAgent/3.0               | 2095         | 2010-09-10 | 14:48:06   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2095           | 192.168.1.253    | VaxSIPUserAgent/3.0               | 2095         | 2010-09-10 | 14:48:57   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2095           | 192.168.1.253    | VaxSIPUserAgent/3.0               | 2095         | 2010-09-10 | 14:49:11   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2095           | 192.168.1.253    | VaxSIPUserAgent/3.0               | 2095         | 2010-09-10 | 14:49:36   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094           | 192.168.0.99     | SIPPER for PhonerLite             | 2094         | 2010-09-10 | 23:46:18   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094           | 192.168.0.99     | SIPPER for PhonerLite             | 2094         | 2010-09-10 | 23:46:50   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 1022           | 92.81.245.67     | Zoiper rev.5324                   | 1022         | 2010-09-11 | 03:16:28   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 1022           | 192.168.1.253    | VaxSIPUserAgent/3.0               | 1022         | 2010-09-14 | 16:27:14   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 1022           | 192.168.1.253    | VaxSIPUserAgent/3.0               | 1022         | 2010-09-14 | 16:27:17   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 1022           | 192.168.1.253    | VaxSIPUserAgent/3.0               | 1022         | 2010-09-14 | 16:27:42   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2097           | 151.53.90.159    | 2097                              | 2010-09-21   | 2010-09-22 | 00:20:10   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094           | 192.168.1.4      | eyeBeam release 3006o stamp 17551 | 2094         | 2010-09-21 | 10:11:17   |
| 2bea8b0fbca55db00353246508129573eb329a2d | 2094           | 192.168.1.4      | eyeBeam release 3006o stamp 17551 | 2094         | 2010-09-21 | 10:11:56   |
+------------------------------------------+----------------+------------------+-----------------------------------+--------------+------------+------------+
22 rows in set, 1 warning (0.01 sec)