<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Dear All, <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">With the experience of these scans during the last months I was interested to know more about the intentions of these hackers. Therefore I created a subdomain also with reverse lookup for an IP-range which is not used. As these lookups
for my in-addr.arpa. range are still ongoing it was not surprising that after short time the dots in the geo-map are spread over the world. Looking for names in this subdomain is only possible if someone did a reverse lookup before. Assuming that the same
source IP addresses respectively domains for name lookups are identical to those for reverse lookup is completely wrong. This is a list of all IP addresses which did a lookup for this honeypot names during the last 5 days:
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">3.208.24.74 ec2-3-208-24-74.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">3.80.93.35 ec2-3-80-93-35.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">3.85.93.0 ec2-3-85-93-0.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">3.88.100.109 ec2-3-88-100-109.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">3.90.201.243 ec2-3-90-201-243.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">3.91.30.123 ec2-3-91-30-123.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">3.95.226.247 ec2-3-95-226-247.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">13.52.77.52 ec2-13-52-77-52.us-west-1.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">13.56.168.100 ec2-13-56-168-100.us-west-1.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">13.57.211.248 ec2-13-57-211-248.us-west-1.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">18.144.22.236 ec2-18-144-22-236.us-west-1.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">18.205.25.35 ec2-18-205-25-35.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">18.236.162.184 ec2-18-236-162-184.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">18.237.104.100 ec2-18-237-104-100.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">34.201.112.86 ec2-34-201-112-86.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">34.203.34.125 ec2-34-203-34-125.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">34.209.72.240 ec2-34-209-72-240.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">34.211.107.180 ec2-34-211-107-180.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">34.217.215.120 ec2-34-217-215-120.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">34.219.162.16 ec2-34-219-162-16.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">34.220.201.91 ec2-34-220-201-91.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">34.221.117.253 ec2-34-221-117-253.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">34.222.137.205 ec2-34-222-137-205.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">34.224.174.188 ec2-34-224-174-188.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">34.228.69.14 ec2-34-228-69-14.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">34.230.19.93 ec2-34-230-19-93.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">35.160.244.197 ec2-35-160-244-197.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">35.167.192.183 ec2-35-167-192-183.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">52.11.241.28 ec2-52-11-241-28.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">52.12.187.35 ec2-52-12-187-35.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">52.53.152.137 ec2-52-53-152-137.us-west-1.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">52.89.35.100 ec2-52-89-35-100.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.145.15.148 ec2-54-145-15-148.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.153.106.24 ec2-54-153-106-24.us-west-1.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.160.224.178 ec2-54-160-224-178.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.164.10.21 ec2-54-164-10-21.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.167.59.28 ec2-54-167-59-28.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.177.42.164 ec2-54-177-42-164.us-west-1.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.183.206.159 ec2-54-183-206-159.us-west-1.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.186.47.231 ec2-54-186-47-231.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.191.144.173 ec2-54-191-144-173.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.193.100.84 ec2-54-193-100-84.us-west-1.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.201.110.109 ec2-54-201-110-109.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.209.142.179 ec2-54-209-142-179.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.210.87.43 ec2-54-210-87-43.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.212.39.71 ec2-54-212-39-71.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.214.127.179 ec2-54-214-127-179.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.215.240.32 ec2-54-215-240-32.us-west-1.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.218.221.102 ec2-54-218-221-102.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.219.151.85 ec2-54-219-151-85.us-west-1.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.221.33.71 ec2-54-221-33-71.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.241.187.214 ec2-54-241-187-214.us-west-1.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.242.169.195 ec2-54-242-169-195.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.67.89.221 ec2-54-67-89-221.us-west-1.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.70.125.167 ec2-54-70-125-167.us-west-2.compute.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">54.82.20.141 ec2-54-82-20-141.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">69.175.15.106 server.ssc-singlehop1.com.<o:p></o:p></p>
<p class="MsoNormal">71.6.165.142<o:p></o:p></p>
<p class="MsoNormal">74.125.190.150<o:p></o:p></p>
<p class="MsoNormal">107.20.131.196 ec2-107-20-131-196.compute-1.amazonaws.com.<o:p></o:p></p>
<p class="MsoNormal">107.6.173.166 api-5.resolver.prd.daymax.xyz.<o:p></o:p></p>
<p class="MsoNormal">198.143.174.170 api-6.resolver.prd.daymax.xyz.<o:p></o:p></p>
<p class="MsoNormal"><span lang="DE-AT">208.100.26.239 ip239.208-100-26.static.steadfastdns.net.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-AT">240e:13:1800:100::123<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="DE-AT"><o:p> </o:p></span></p>
<p class="MsoNormal">So 7 of total 64 IP addresses are not coming from amazonaws.com
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Kind regards<o:p></o:p></p>
<p class="MsoNormal">Hans <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4">--<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4">Ing. Dipl.-Ing. Hans Mayer<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4">Systems Administrator<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4">Information and Communication Technologies (ICT)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4">International Institute for Applied Systems Analysis (IIASA)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4">Schlossplatz 1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4">A-2361 Laxenburg, Austria<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4">Phone: +43 2236 807 Ext 215<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4">Mobile: +43 676 83 807 215<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4">Web: <a href="http://www.iiasa.at">
<span style="color:#0563C1">http://www.iiasa.at</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4">E-Mail: <a href="mailto:mayer@iiasa.ac.at">
<span style="color:#0563C1">mayer@iiasa.ac.at</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#5B9BD5"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#5B9BD5">Note: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#5B9BD5"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#548DD4"><o:p> </o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>