{"id":30311,"date":"2019-10-31T21:34:49","date_gmt":"2019-10-31T18:34:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/analiz-atak-na-hanipot-cowrie\/"},"modified":"2019-10-31T21:34:49","modified_gmt":"2019-10-31T18:34:49","slug":"analiz-atak-na-hanipot-cowrie","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/analiz-atak-na-hanipot-cowrie","title":{"rendered":"R\u00fcnnakute anal\u00fc\u00fcs hanipoti Cowrie","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><b>Statistika 24 tunni jooksul p\u00e4rast hanipoti paigaldamist Digital Oceanis Singapuris<\/b> <\/p>\n<h1>Piu-piu! Alustame otse r\u00fcnnakute kaardilt<\/h1>\n<p>\nMeie superlahe kaart n\u00e4itab unikaalseid ASN-e, mis on 24 tunni jooksul meie Cowrie hanipotiga \u00fchendust loonud. Kollane t\u00e4histab SSH-\u00fchendusi ja punane Telneti \u00fchendusi. Sellised animatsioonid l\u00f6\u00f6vad sageli ettev\u00f5tte n\u00f5ukogu pahviks, aidates saavutada rohkem rahastust turvalisuse ja ressursside jaoks. Siiski on kaardil teatud v\u00e4\u00e4rtus, kuna see selgelt n\u00e4itab r\u00fcnnakuallikate geograafilist ja organisatsioonilist jaotust meie hosti osas vaid 24 tunni jooksul. Animatsioonis ei kajastu iga r\u00fcnnakuallika liiklust volume.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>Mis on Pew Pew kaart?<\/h3>\n<p>\n<i>Pew Pew kaart<\/i> \u2014 see on <noindex><a rel=\"nofollow\" href=\"https:\/\/krebsonsecurity.com\/2015\/01\/whos-attacking-whom-realtime-attack-trackers\/\">k\u00fcberr\u00fcnnakute visualiseerimine<\/a><\/noindex>, tavaliselt animatsiooniga ja v\u00e4ga ilus. See on moodne viis oma toote m\u00fc\u00fcmiseks, olles tuntud selle poolest, et Norse Corp. kasutas seda. Ettev\u00f5te l\u00f5petas halvasti: selgus, et ilusate animatsioonide \u00fcle uhkustamine oli nende ainus tugevus ja anal\u00fc\u00fcsi jaoks kasutati eba\u00fchtlasi andmeid.<\/p>\n<h3>Valmistatud Leafletjs abil<\/h3>\n<p>\nNeed for those who want to develop an attack map for a large screen in the operations center (your boss will love it), there is a library <noindex><a rel=\"nofollow\" href=\"https:\/\/leafletjs.com\/\">leafletjs<\/a><\/noindex>. We combine it with the <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/lit-forest\/leaflet.migrationLayer\">leaflet migration layer<\/a><\/noindex>, Maxmind GeoIP service \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/hackertarget.com\/pewpew\/map.html\">and it's ready<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/hackertarget.com\/pewpew\/map.html\"><img decoding=\"async\" alt=\"R\u00fcnnakute anal\u00fc\u00fcs hanipoti Cowrie\" src=\"\/wp-content\/uploads\/2019\/03\/c4765ba5f2c89e502e5d8791dcfcfc62.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h1>WTF: what is this Cowrie honeypot?<\/h1>\n<p>\nA honeypot is a system that is set up in the network specifically to lure attackers. Connections to the system are usually unauthorized and allow for the detection of the attacker through detailed logs. The logs retain not only the usual connection information but also session information revealing <b>the techniques, tactics, and procedures (TTP)<\/b> of the attacker.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/micheloosterhof\/cowrie\">The Cowrie honeypot<\/a><\/noindex> is designed for <b>logging SSH and Telnet connections.<\/b>Such honeypots are often exposed to the internet to track the tools, scripts, and hosts of attackers.<\/p>\n<blockquote><p>My message to companies that think they are not being attacked: 'You are searching poorly.'<br \/>\n<i>\u2014 James Snook<\/i><\/p><\/blockquote>\n<p>\n<img decoding=\"async\" alt=\"R\u00fcnnakute anal\u00fc\u00fcs hanipoti Cowrie\" src=\"\/wp-content\/uploads\/2019\/03\/40feddaacc42add563f98a0f64c1c3b0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h1>What's in the logs?<\/h1>\n<p><\/p>\n<h3>Total number of connections<\/h3>\n<p>\nPaljudest hostidest on korduvalt olnud \u00fcritusi \u00fchenduda. See on normaalne, kuna r\u00fcndavate skriptide sees on salvestatud kasutajatunnuste nimekiri ning nad proovivad erinevaid kombinatsioone. Cowrie honeypot on seadistatud teatud kasutajanime ja parooli kombinatsioonide vastuv\u00f5tmiseks. Seda saab seadistada <b>failis user.db<\/b>.<\/p>\n<p><img decoding=\"async\" alt=\"R\u00fcnnakute anal\u00fc\u00fcs hanipoti Cowrie\" src=\"\/wp-content\/uploads\/2019\/03\/d7da6ec208e821453607fb6c29c7e347.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>R\u00fcnnakute geograafia<\/h3>\n<p>\nMaxmindi geolokatsiooni andmete p\u00f5hjal olen arvestanud \u00fchenduste arvu igast riigist. Brasiilia ja Hiina on selgelt esikohal, nendest riikidest tuleb tihti tugev h\u00e4\u00e4l skanneerijatelt.<\/p>\n<p><img decoding=\"async\" alt=\"R\u00fcnnakute anal\u00fc\u00fcs hanipoti Cowrie\" src=\"\/wp-content\/uploads\/2019\/03\/0dd7a52da1c12db2f317f2195e92bccf.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>IPv4-aadressi pidaja<\/h3>\n<p>\nIPv4-aadresside pidajate (ASN) uurimine v\u00f5ib paljastada organisatsioone, millel on suur hulk r\u00fcndavaid hoste. Loomulikult tuleb alati meeles pidada, et paljud r\u00fcnnakud tulevad nakatunud hostidelt. On m\u00f5istlik eeldada, et enamik kurjategijaid ei ole nii tobedad, et skanneerida v\u00f5rku kodukompuutrist.<\/p>\n<p><img decoding=\"async\" alt=\"R\u00fcnnakute anal\u00fc\u00fcs hanipoti Cowrie\" src=\"\/wp-content\/uploads\/2019\/03\/0f60be7772ea993e2c0a5d0ab6c08cd8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>R\u00fcndavate s\u00fcsteemide avatud porte (anda Shodan.io)<\/h3>\n<p>\nIP-loendi l\u00e4biviimine l\u00e4bi suurep\u00e4rase <noindex><a rel=\"nofollow\" href=\"https:\/\/developer.shodan.io\/\">Shodan API<\/a><\/noindex> tugevalt tuvastab <b>avatud portidega s\u00fcsteemid<\/b> ja mis need pordid on. Alloleval joonisel on n\u00e4idatud avatud portide kontsentratsioon riikide ja organisatsioonide l\u00f5ikes. Oleks v\u00f5inud tuvastada kompromiteeritud s\u00fcsteemide blokeeringud, kuid piirides <b>v\u00e4ikest valimit<\/b> ei paista midagi silmapaistvat, v\u00e4lja arvatud suur hulk <b>avatud porte 500 Hiinas<\/b>.<\/p>\n<p>Huvitav leid \u2014 suur hulk s\u00fcsteeme Brasiilias, millel <b>pole avatud 22, 23<\/b> v\u00f5i <b>teised pordid<\/b>, Censys ja Shodan andmetel. Tundub, et need on \u00fchendused l\u00f5ppkasutajate arvutitest.<\/p>\n<p><img decoding=\"async\" alt=\"R\u00fcnnakute anal\u00fc\u00fcs hanipoti Cowrie\" src=\"\/wp-content\/uploads\/2019\/03\/6138379c7d069807f01b57a8d97784fb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <\/p>\n<h3>Robotid? Mitte tingimata<\/h3>\n<p>\nAndmed <noindex><a rel=\"nofollow\" href=\"https:\/\/censys.io\/\">Censys<\/a><\/noindex> pordid 22 ja 23 selle p\u00e4eva jooksul n\u00e4itasid kummalist olnud. Eeldasin, et enamik skaneerimistest ja parooli r\u00fcnnakutest tuleb robotitest. Skript levib avatud portide kaudu, proovides paroole, ja uuele s\u00fcsteemile kopeerib end ning j\u00e4tkab sama meetodiga levikut.<\/p>\n<p>Aga siin on n\u00e4ha, et vaid v\u00e4ikese hulga hostide puhul, kes skaneerivad telnet'i, on avatud v\u00e4ljastpoolt port 23. See t\u00e4hendab, et s\u00fcsteemid on kas kompromiteeritud muude meetoditega v\u00f5i r\u00fcndajad k\u00e4ivitavad skripte k\u00e4sitsi.<\/p>\n<p><img decoding=\"async\" alt=\"R\u00fcnnakute anal\u00fc\u00fcs hanipoti Cowrie\" src=\"\/wp-content\/uploads\/2019\/03\/4c3ccbc609a46365473f582315ca90bd.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Kodusised \u00fchendused<\/h3>\n<p>\nTeine huvitav leid oli suur hulk koduseid kasutajaid valimis. Aitab <b>tagasivaate kaudu <\/b> Ma m\u00e4\u00e4rasin 105 \u00fchendust konkreetselt koduarvutitest. Paljude kodu\u00fchenduste puhul n\u00e4itab p\u00f6\u00f6rdvaate DNS hostinime, kus on s\u00f5nad dsl, home, cable, fiber ja nii edasi.<\/p>\n<p><img decoding=\"async\" alt=\"R\u00fcnnakute anal\u00fc\u00fcs hanipoti Cowrie\" src=\"\/wp-content\/uploads\/2019\/03\/a665a90dfdbbfb5e9971fb2885ccd669.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h1>\u00d5ppige ja uurige: seadistage oma isiklik kanepott.<\/h1>\n<p>\nHiljuti kirjutasin l\u00fchikese k\u00e4siraamatu, kuidas <noindex><a rel=\"nofollow\" href=\"https:\/\/hackertarget.com\/cowrie-honeypot-ubuntu\/\">seada oma s\u00fcsteemis \u00fcles kanepott Cowrie.<\/a><\/noindex>. Nagu juba mainitud, kasutasime meie juhul Digital Ocean VPS-i Singapuris. 24 tunni anal\u00fc\u00fcsi maksumus oli s\u00f5na otseses m\u00f5ttes vaid m\u00f5ned sendid ja s\u00fcsteemi seadistamiseks kulus 30 minutit.<\/p>\n<p>Selle asemel, et k\u00e4ivitada Cowrie internetis ja p\u00fc\u00fcda kogu m\u00fcra, saate kanepotist kasu saada kohalikus v\u00f5rgus. Lihtsalt seadistage teatis, kui teatud portidele tehakse p\u00e4ringuid. See t\u00e4hendab, et kas on r\u00fcndaja v\u00f5rgus, uudishimulik t\u00f6\u00f6taja v\u00f5i haavatavuste skaneerimine.<\/p>\n<h1>J\u00e4reldused<\/h1>\n<p>\nP\u00e4rast \u00fche p\u00e4eva jooksul r\u00fcndajate tegevuste vaatamist on selge, et mingi r\u00fcnnaku selge allika v\u00e4ljaselgitamine mingist organisatsioonist, riigist v\u00f5i isegi operatsioonis\u00fcsteemist ei ole v\u00f5imalik.<\/p>\n<p>Lai m\u00e4\u00e4rata skaneerimisauti oma ohutusmeetmes, tuleb veenduda, et s\u00fcsteem <b>omab mitmeid turvatasemeid<\/b>. Levinud ja t\u00f5hus lahendus oleks teenuse liigutamine juhuslikule k\u00f5rgele portile. See ei vabasta vajadusest ranged paroolide kaitse ja j\u00e4lgimise j\u00e4rele, kuid v\u00e4hemalt tagab, et logid ei t\u00e4itu pideva skaneerimisega. \u00dchendused k\u00f5rgele portile \u2014 need on t\u00f5en\u00e4olisemalt sihitud r\u00fcnnakud, mis v\u00f5ivad teid huvitada. <b>SSH<\/b> Tihti asuvad avatud telneti portid ruuterites v\u00f5i muudes seadmetes, nii et neid ei saa lihtsalt k\u00f5rgele portile \u00fcmber paigutada.<\/p>\n<p>Teave k\u00f5igi avatud portide <noindex><a rel=\"nofollow\" href=\"https:\/\/hackertarget.com\/nmap-online-port-scanner\/\">r\u00fcndepind<\/a><\/noindex> ja <noindex><a rel=\"nofollow\" href=\"https:\/\/hackertarget.com\/domain-profiler\/\">\u2014 ainus viis veenduda, et need teenused on tulem\u00fc\u00fcriga kaitstud v\u00f5i v\u00e4lja l\u00fclitatud. V\u00f5imaluse korral tuleks Telnetit \u00fcldse v\u00e4ltida, see protokoll ei ole kr\u00fcpteeritud. Kui see on h\u00e4davajalik ja ilma selleta ei saa, siis j\u00e4lgige seda hoolikalt ja kasutage usaldusv\u00e4\u00e4rseid paroole.<\/a><\/noindex> \u2014 ainus viis veenduda, et need teenused on kaitstud tulem\u00fc\u00fcriga v\u00f5i on deaktiveeritud. Kui v\u00f5imalik, v\u00e4ltige Telnet'i kasutamist, kuna see protokoll ei ole kr\u00fcpteeritud. Kui see on vajalik ja ei saa teisiti, j\u00e4lgige seda hoolikalt ning kasutage usaldusv\u00e4\u00e4rseid paroole.<br \/>\n<br \/>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/436076\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0437\u0430 24 \u0447\u0430\u0441\u0430 \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 Digital Ocean \u0432 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435 \u041f\u0438\u0443-\u043f\u0438\u0443! \u041d\u0430\u0447\u043d\u0451\u043c \u0441\u0440\u0430\u0437\u0443 \u0441 \u043a\u0430\u0440\u0442\u044b \u0430\u0442\u0430\u043a \u041d\u0430\u0448\u0430 \u0441\u0443\u043f\u0435\u0440\u043a\u043b\u0430\u0441\u0441\u043d\u0430\u044f \u043a\u0430\u0440\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 ASN, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u043b\u0438\u0441\u044c \u043a \u043d\u0430\u0448\u0435\u043c\u0443 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0443 Cowrie \u0437\u0430 24 \u0447\u0430\u0441\u0430. \u0416\u0451\u043b\u0442\u044b\u0439 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 SSH-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u043c, \u0430 \u043a\u0440\u0430\u0441\u043d\u044b\u0439\u00a0\u2014 Telnet. \u0422\u0430\u043a\u0438\u0435 \u0430\u043d\u0438\u043c\u0430\u0446\u0438\u0438 \u0447\u0430\u0441\u0442\u043e \u0432\u043f\u0435\u0447\u0430\u0442\u043b\u044f\u044e\u0442 \u0441\u043e\u0432\u0435\u0442 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0431\u0438\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 \u0444\u0438\u043d\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30311","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.0.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0437\u0430 24 \u0447\u0430\u0441\u0430 \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 Digital Ocean \u0432 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435 \u041f\u0438\u0443-\u043f\u0438\u0443! \u041d\u0430\u0447\u043d\u0451\u043c \u0441\u0440\u0430\u0437\u0443 \u0441 \u043a\u0430\u0440\u0442\u044b \u0430\u0442\u0430\u043a \u041d\u0430\u0448\u0430 \u0441\u0443\u043f\u0435\u0440\u043a\u043b\u0430\u0441\u0441\u043d\u0430\u044f \u043a\u0430\u0440\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 ASN, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u043b\u0438\u0441\u044c \u043a \u043d\u0430\u0448\u0435\u043c\u0443 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0443 Cowrie \u0437\u0430 24 \u0447\u0430\u0441\u0430. \u0416\u0451\u043b\u0442\u044b\u0439 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 SSH-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u043c, \u0430 \u043a\u0440\u0430\u0441\u043d\u044b\u0439 \u2014 Telnet. \u0422\u0430\u043a\u0438\u0435 \u0430\u043d\u0438\u043c\u0430\u0446\u0438\u0438 \u0447\u0430\u0441\u0442\u043e \u0432\u043f\u0435\u0447\u0430\u0442\u043b\u044f\u044e\u0442 \u0441\u043e\u0432\u0435\u0442 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0431\u0438\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 \u0444\u0438\u043d\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/analiz-atak-na-hanipot-cowrie\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.0.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u043d\u0430\u043b\u0438\u0437 \u0430\u0442\u0430\u043a \u043d\u0430 \u0445\u0430\u043d\u0438\u043f\u043e\u0442 Cowrie | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0437\u0430 24 \u0447\u0430\u0441\u0430 \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 Digital Ocean \u0432 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435 \u041f\u0438\u0443-\u043f\u0438\u0443! \u041d\u0430\u0447\u043d\u0451\u043c \u0441\u0440\u0430\u0437\u0443 \u0441 \u043a\u0430\u0440\u0442\u044b \u0430\u0442\u0430\u043a \u041d\u0430\u0448\u0430 \u0441\u0443\u043f\u0435\u0440\u043a\u043b\u0430\u0441\u0441\u043d\u0430\u044f \u043a\u0430\u0440\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 ASN, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u043b\u0438\u0441\u044c \u043a \u043d\u0430\u0448\u0435\u043c\u0443 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0443 Cowrie \u0437\u0430 24 \u0447\u0430\u0441\u0430. \u0416\u0451\u043b\u0442\u044b\u0439 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 SSH-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u043c, \u0430 \u043a\u0440\u0430\u0441\u043d\u044b\u0439 \u2014 Telnet. \u0422\u0430\u043a\u0438\u0435 \u0430\u043d\u0438\u043c\u0430\u0446\u0438\u0438 \u0447\u0430\u0441\u0442\u043e \u0432\u043f\u0435\u0447\u0430\u0442\u043b\u044f\u044e\u0442 \u0441\u043e\u0432\u0435\u0442 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0431\u0438\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 \u0444\u0438\u043d\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/analiz-atak-na-hanipot-cowrie\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:34:49+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:34:49+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47R\u00fcnnakute anal\u00fc\u00fcs Cowrie honeypotil | ProHoster","description":"Statistika 24 tunni jooksul p\u00e4rast honeypoti paigaldamist Digital Oceanis Singapuris. Piu-piu! Alustame kohe r\u00fcnnakute kaardiga. Meie superkaardil on n\u00e4ha ainulaadsed ASN-id, mis on meie Cowrie honeypoti 24 tunni jooksul \u00fchendusse tulnud. Kollane vastab SSH-\u00fchendustele ja punane \u2014 Telnet. Sellised animatsioonid m\u00f5juvad sageli ettev\u00f5tte juhatusele muljetavaldavalt, mis aitab saada rohkem rahastust turvalisuse jaoks.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/analiz-atak-na-hanipot-cowrie","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u043d\u0430\u043b\u0438\u0437 \u0430\u0442\u0430\u043a \u043d\u0430 \u0445\u0430\u043d\u0438\u043f\u043e\u0442 Cowrie | ProHoster","og:description":"\u0421\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0437\u0430 24 \u0447\u0430\u0441\u0430 \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 Digital Ocean \u0432 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435 \u041f\u0438\u0443-\u043f\u0438\u0443! \u041d\u0430\u0447\u043d\u0451\u043c \u0441\u0440\u0430\u0437\u0443 \u0441 \u043a\u0430\u0440\u0442\u044b \u0430\u0442\u0430\u043a \u041d\u0430\u0448\u0430 \u0441\u0443\u043f\u0435\u0440\u043a\u043b\u0430\u0441\u0441\u043d\u0430\u044f \u043a\u0430\u0440\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 ASN, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u043b\u0438\u0441\u044c \u043a \u043d\u0430\u0448\u0435\u043c\u0443 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0443 Cowrie \u0437\u0430 24 \u0447\u0430\u0441\u0430. \u0416\u0451\u043b\u0442\u044b\u0439 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 SSH-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u043c, \u0430 \u043a\u0440\u0430\u0441\u043d\u044b\u0439 \u2014 Telnet. \u0422\u0430\u043a\u0438\u0435 \u0430\u043d\u0438\u043c\u0430\u0446\u0438\u0438 \u0447\u0430\u0441\u0442\u043e \u0432\u043f\u0435\u0447\u0430\u0442\u043b\u044f\u044e\u0442 \u0441\u043e\u0432\u0435\u0442 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0431\u0438\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 \u0444\u0438\u043d\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438","og:url":"https:\/\/prohoster.info\/et\/blog\/analiz-atak-na-hanipot-cowrie","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:49+00:00","article:modified_time":"2019-10-31T18:34:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30311","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:36:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:36:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/30311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=30311"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/30311\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=30311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=30311"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=30311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}