bad_packets
Fraudulent IPv4 space do not route these prefixes
Amazon acquires 4M IPv4 addresses from AMPRNet for several million dollars
London Metropolitan Police Twitter and Website Hacked
Running list of botnet C2 server detections
BlueKeep vulnerability scans detected last 24 hours
Top ports/services targeted by Mirai-like botnets since 2019-05-01
Andypandy botnet C2 detections last 7 days
104.244.76.15 (🇱🇺) 209.141.55.73 (🇺🇸) 193.70.26.48 (🇫🇷) 181.197.5.215 (🇵🇦)Mainly targets Android Debug Bridge (ADB) endpoints (5555/tcp). Recon scan uses ZMap.
Forbes Magazine website compromised with magecart malware
Re:Over 25k Linksys routers vulnerable to sensitive information disclo...
on Tuesday May 14, 2019 @03:47AM (#19907583)
Will add to the post, thanks for the recommendation.
Over 25k Linksys routers vulnerable to sensitive information disclosure flaw
Over 25,000 Linksys Smart Wi-Fi routers leaking sensitive device information
Hundreds of hosts incorrectly tagged as “internet scanners” on Shodan
Check AS10794, AS49758, AS8435, AS26381, AS25869, AS4199, AS11685, AS4205, AS10934, AS14121, AS7741, and AS63199 for examples.Seems odd that spoofed traffic gets you listed on Shodan as an "internet scanner" – why aren't there controls in place to prevent this misinformation?
Re:Ask HN: What's the founding story of your startup?
on Thursday April 18, 2019 @08:43PM (#19696091)
Where did the idea come from?
Watching Splunk dashboards of network traffic all day long.
Who built the first version of your product? I did while I was recovering from major surgery.
How did the founding team come together? We joined forces to collaborate and share our threat intelligence data.
Did you raise money or are you bootstrapped? Bootstrapped.
What have been your greatest triumphs? Seeing our work featured in the The Wall Street Journal, The Washington Post, Forbes, Krebs on Security, and many other major publications. And co-authoring a peer-reviewed academic research paper, "A first look at browser-based cryptojacking."
How to steal WordPress database credentials and security keys
Defunct WordPress plugin allows directory traversal to leak database credentials
WordPress sites are vulnerable to sensitive information disclosure
Google Cloud abused to conduct DNS hijacking attacks against Google services
Ongoing DNS hijacking campaign targeting D-Link routers
Ongoing DNS hijacking campaign targeting consumer routers
8k Cisco RV320/RV325 routers are still leaking their admin credentials
Cisco firmware update for RV320/RV325 routers simply blacklisted the UA for curl
Remote DNS changing exploit attempt targeting 5 different router models
Source IP Country ASN ASN Name User Agent Method URI Target Device Target Port Date Last Seen 35.229.230.36 United States AS15169 " Google LLC" curl/7.52.1 GET /action?dns_status=1&dns_poll_timeout=2&id=57&dns_server_ip_1=195&dns_server_ip_2=128&dns_server_ip_3=126&dns_server_ip_4=165&priority=1&cmdadd=add DSLink 260E Routers 81/tcp...