这是一个创建于 2944 天前的主题，其中的信息可能已经有所发展或是发生改变。
收到微软的报警邮件，昨晚个人 hotmail 邮箱帐号也就是微软帐号 被一个美国 ip 216.255.126.125 登录了，系统 ios ， safari 浏览器。估计邮件和 onedrive ， onenote 已经被拖了，奇怪的是登录的帐号不是主邮箱而是别名，别名好像只有 skype 才能看到，但我从不用 skype ，自己只有两台电脑用主邮箱名登录 win10 和 win8 。这背后说明什么问题？ 是密码被爆破了，还是我这有马？帐号 15 位数字和英文组合，跑的微软自家杀毒，无任何第三方 metro app ，无任何无签名应用，纯 office 办公用。
我扫了一下那个 ip ，感觉像个蜜罐
Nmap scan report for 216.255.126.124
Host is up (0.26s latency).
Not shown: 970 closed ports
PORT STATE SERVICE
1/tcp open tcpmux
7/tcp open echo
9/tcp open discard
13/tcp open daytime
19/tcp open chargen
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
37/tcp open time
79/tcp open finger
80/tcp open http
110/tcp open pop3
111/tcp open rpcbind
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
143/tcp open imap
199/tcp open smux
445/tcp filtered microsoft-ds
512/tcp open exec
513/tcp open login
514/tcp open shell
587/tcp open submission
593/tcp filtered http-rpc-epmap
901/tcp open samba-swat
1026/tcp open LSA-or-nterm
1027/tcp open IIS
1028/tcp open unknown
1029/tcp open ms-lsa
2049/tcp open nfs
4444/tcp filtered krb524
Device type: general purpose
Running (JUST GUESSING): OpenBSD 4.X (85%)
OS CPE: cpe:/o:openbsd:openbsd:4.3
Aggressive OS guesses: OpenBSD 4.3 (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: -38 hops
TCP Sequence Prediction: Difficulty=260 (Good luck!)
IP ID Sequence Generation: Busy server or unknown class
Read data files from: /usr/bin/../share/nmap
OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 480.08 seconds
Raw packets sent: 1409 (66.192KB) | Rcvd: 1474 (65.148KB)
我扫了一下那个 ip ，感觉像个蜜罐
Nmap scan report for 216.255.126.124
Host is up (0.26s latency).
Not shown: 970 closed ports
PORT STATE SERVICE
1/tcp open tcpmux
7/tcp open echo
9/tcp open discard
13/tcp open daytime
19/tcp open chargen
21/tcp open ftp
22/tcp open ssh
25/tcp open smtp
37/tcp open time
79/tcp open finger
80/tcp open http
110/tcp open pop3
111/tcp open rpcbind
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
143/tcp open imap
199/tcp open smux
445/tcp filtered microsoft-ds
512/tcp open exec
513/tcp open login
514/tcp open shell
587/tcp open submission
593/tcp filtered http-rpc-epmap
901/tcp open samba-swat
1026/tcp open LSA-or-nterm
1027/tcp open IIS
1028/tcp open unknown
1029/tcp open ms-lsa
2049/tcp open nfs
4444/tcp filtered krb524
Device type: general purpose
Running (JUST GUESSING): OpenBSD 4.X (85%)
OS CPE: cpe:/o:openbsd:openbsd:4.3
Aggressive OS guesses: OpenBSD 4.3 (85%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: -38 hops
TCP Sequence Prediction: Difficulty=260 (Good luck!)
IP ID Sequence Generation: Busy server or unknown class
Read data files from: /usr/bin/../share/nmap
OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 480.08 seconds
Raw packets sent: 1409 (66.192KB) | Rcvd: 1474 (65.148KB)
第 1 条附言 · 2016-11-03 09:04:05 +08:00
入侵的那个地址看来是个 ssh proxy ：
http://proxylivedaily.blogspot.se/search?q=216.255.126.124
http://proxylivedaily.blogspot.se/search?q=216.255.126.124
Select Language