{"id":30311,"date":"2019-10-31T21:34:49","date_gmt":"2019-10-31T18:34:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/analiz-atak-na-hanipot-cowrie\/"},"modified":"2019-10-31T21:34:49","modified_gmt":"2019-10-31T18:34:49","slug":"analiz-atak-na-hanipot-cowrie","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pt\/blog\/analiz-atak-na-hanipot-cowrie","title":{"rendered":"An\u00e1lise de ataques ao honeypot Cowrie","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><b>Estat\u00edsticas das 24 horas ap\u00f3s a instala\u00e7\u00e3o do honeypot no n\u00f3 Digital Ocean em Cingapura<\/b> <\/p>\n<h1>Piu-piu! Vamos come\u00e7ar com o mapa de ataques<\/h1>\n<p>\nNosso super legal mapa mostra ASN \u00fanicos que se conectaram ao nosso honeypot Cowrie nas \u00faltimas 24 horas. O amarelo corresponde \u00e0s conex\u00f5es SSH, enquanto o vermelho representa Telnet. Essas anima\u00e7\u00f5es frequentemente impressionam o conselho da empresa, o que ajuda a garantir mais financiamento para seguran\u00e7a e recursos. No entanto, o mapa possui certo valor, demonstrando claramente a dissemina\u00e7\u00e3o geogr\u00e1fica e organizacional das fontes de ataque ao nosso host em apenas 24 horas. A anima\u00e7\u00e3o n\u00e3o reflete o volume de tr\u00e1fego de cada fonte.<br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h3>O que \u00e9 o mapa Pew Pew?<\/h3>\n<p>\n<i>Mapa Pew Pew<\/i> seja <noindex><a rel=\"nofollow\" href=\"https:\/\/krebsonsecurity.com\/2015\/01\/whos-attacking-whom-realtime-attack-trackers\/\">visualiza\u00e7\u00e3o de ciberataques<\/a><\/noindex>, geralmente animado e muito bonito. \u00c9 uma forma moderna de vender seu produto, tristemente famosa por ter sido usada pela Norse Corp. A empresa teve um final ruim: descobriu-se que as anima\u00e7\u00f5es bonitas eram seu \u00fanico m\u00e9rito, enquanto os dados utilizados para an\u00e1lise eram fragment\u00e1rios.<\/p>\n<h3>Feito com Leafletjs<\/h3>\n<p>\nPara aqueles que desejam desenvolver um mapa de ataques para uma grande tela em um centro de opera\u00e7\u00f5es (seu chefe vai adorar), existe uma biblioteca <noindex><a rel=\"nofollow\" href=\"https:\/\/leafletjs.com\/\">leafletjs<\/a><\/noindex>. Integrando-a com o plugin <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/lit-forest\/leaflet.migrationLayer\">de camada de migra\u00e7\u00e3o leaflet<\/a><\/noindex>, o servi\u00e7o Maxmind GeoIP \u2014 <noindex><a rel=\"nofollow\" href=\"https:\/\/hackertarget.com\/pewpew\/map.html\">e pronto<\/a><\/noindex>.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/hackertarget.com\/pewpew\/map.html\"><img decoding=\"async\" alt=\"An\u00e1lise de ataques ao honeypot Cowrie\" src=\"\/wp-content\/uploads\/2019\/03\/c4765ba5f2c89e502e5d8791dcfcfc62.jpg\" style=\"display:block;margin: 0 auto;\" \/><\/a><\/noindex><\/p>\n<h1>WTF: o que \u00e9 esse honeypot Cowrie?<\/h1>\n<p>\nUm honeypot \u00e9 um sistema que \u00e9 colocado na rede especificamente para atrair atacantes. As conex\u00f5es com o sistema geralmente s\u00e3o ilegais e permitem identificar o invasor por meio de logs detalhados. Os logs mant\u00eam n\u00e3o apenas informa\u00e7\u00f5es comuns sobre a conex\u00e3o, mas tamb\u00e9m informa\u00e7\u00f5es sobre a sess\u00e3o, revelando <b>t\u00e9cnicas, t\u00e1ticas e procedimentos (TTP)<\/b> do atacante.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/micheloosterhof\/cowrie\">O honeypot Cowrie<\/a><\/noindex> \u00e9 destinado a <b>registrar conex\u00f5es SSH e Telnet.<\/b>Esses honeypots frequentemente s\u00e3o expostos na internet para rastrear ferramentas, scripts e hosts de atacantes.<\/p>\n<blockquote><p>Minha mensagem para empresas que pensam que n\u00e3o est\u00e3o sendo atacadas: 'Voc\u00eas est\u00e3o procurando mal'.<br \/>\n<i>\u2014 James Snook<\/i><\/p><\/blockquote>\n<p>\n<img decoding=\"async\" alt=\"An\u00e1lise de ataques ao honeypot Cowrie\" src=\"\/wp-content\/uploads\/2019\/03\/40feddaacc42add563f98a0f64c1c3b0.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h1>O que h\u00e1 nos logs?<\/h1>\n<p><\/p>\n<h3>N\u00famero total de conex\u00f5es<\/h3>\n<p>\nV\u00e1rias tentativas de conex\u00e3o vieram de muitos hosts. Isso \u00e9 normal, pois scripts de ataque t\u00eam listas de credenciais embutidas e tentam v\u00e1rias combina\u00e7\u00f5es. O honeypot Cowrie est\u00e1 configurado para aceitar combina\u00e7\u00f5es espec\u00edficas de nomes de usu\u00e1rio e senhas. Isso \u00e9 configurado no <b>arquivo user.db<\/b>.<\/p>\n<p><img decoding=\"async\" alt=\"An\u00e1lise de ataques ao honeypot Cowrie\" src=\"\/wp-content\/uploads\/2019\/03\/d7da6ec208e821453607fb6c29c7e347.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Geografia dos ataques<\/h3>\n<p>\nDe acordo com a geolocaliza\u00e7\u00e3o da Maxmind, contei o n\u00famero de conex\u00f5es de cada pa\u00eds. O Brasil e a China est\u00e3o no topo, frequentemente acompanhados por um grande volume de tr\u00e1fego de scanners.<\/p>\n<p><img decoding=\"async\" alt=\"An\u00e1lise de ataques ao honeypot Cowrie\" src=\"\/wp-content\/uploads\/2019\/03\/0dd7a52da1c12db2f317f2195e92bccf.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Propriet\u00e1rio do bloco de rede<\/h3>\n<p>\nEstudar os propriet\u00e1rios dos blocos de rede (ASN) pode revelar organiza\u00e7\u00f5es com um grande n\u00famero de hosts atacantes. \u00c9 claro que, nesses casos, deve-se sempre ter em mente que muitos ataques v\u00eam de hosts comprometidos. \u00c9 razo\u00e1vel supor que a maioria dos infratores n\u00e3o seja t\u00e3o ing\u00eanua a ponto de escanear a Rede a partir de um computador dom\u00e9stico.<\/p>\n<p><img decoding=\"async\" alt=\"An\u00e1lise de ataques ao honeypot Cowrie\" src=\"\/wp-content\/uploads\/2019\/03\/0f60be7772ea993e2c0a5d0ab6c08cd8.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Portas abertas em sistemas atacantes (dados do Shodan.io)<\/h3>\n<p>\nExecutar uma lista de IPs atrav\u00e9s do excelente <noindex><a rel=\"nofollow\" href=\"https:\/\/developer.shodan.io\/\">API do Shodan<\/a><\/noindex> determina rapidamente <b>sistemas com portas abertas<\/b> e quais s\u00e3o essas portas. A figura abaixo mostra a concentra\u00e7\u00e3o de portas abertas por pa\u00edses e organiza\u00e7\u00f5es. Poderia-se identificar blocos de sistemas comprometidos, mas dentro de <b>uma pequena amostra<\/b> n\u00e3o h\u00e1 nada extraordin\u00e1rio, exceto a grande quantidade <b>de portas abertas 500 na China<\/b>.<\/p>\n<p>Uma descoberta interessante \u00e9 que um grande n\u00famero de sistemas no Brasil n\u00e3o tem <b>as portas 22, 23<\/b> ou <b>outras portas<\/b>, de acordo com dados do Censys e do Shodan. Aparentemente, essas s\u00e3o conex\u00f5es de computadores de usu\u00e1rios finais.<\/p>\n<p><img decoding=\"async\" alt=\"An\u00e1lise de ataques ao honeypot Cowrie\" src=\"\/wp-content\/uploads\/2019\/03\/6138379c7d069807f01b57a8d97784fb.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n <\/p>\n<h3>Bots? N\u00e3o necessariamente<\/h3>\n<p>\nDados <noindex><a rel=\"nofollow\" href=\"https:\/\/censys.io\/\">Censys<\/a><\/noindex> para as portas 22 e 23 naquele dia mostraram algo estranho. Eu supunha que a maioria dos scans e ataques de for\u00e7a bruta vinha de bots. O script se espalha atrav\u00e9s de portas abertas, tentando senhas, e de um novo sistema copia-se e continua se espalhando pelo mesmo m\u00e9todo.<\/p>\n<p>Mas aqui \u00e9 evidente que apenas um pequeno n\u00famero de hosts que escaneiam telnet tem a porta 23 aberta para fora. Isso significa que os sistemas est\u00e3o comprometidos de outra maneira ou os infratores est\u00e3o executando scripts manualmente.<\/p>\n<p><img decoding=\"async\" alt=\"An\u00e1lise de ataques ao honeypot Cowrie\" src=\"\/wp-content\/uploads\/2019\/03\/4c3ccbc609a46365473f582315ca90bd.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Conex\u00f5es dom\u00e9sticas<\/h3>\n<p>\nOutra descoberta interessante foi a grande quantidade de usu\u00e1rios dom\u00e9sticos na amostra. Com a ajuda do <b>reverse lookup <\/b> , identifiquei 105 conex\u00f5es a partir de computadores dom\u00e9sticos espec\u00edficos. Para muitas conex\u00f5es dom\u00e9sticas, o reverse lookup DNS revela o nome do host com palavras como dsl, home, cable, fiber e assim por diante.<\/p>\n<p><img decoding=\"async\" alt=\"An\u00e1lise de ataques ao honeypot Cowrie\" src=\"\/wp-content\/uploads\/2019\/03\/a665a90dfdbbfb5e9971fb2885ccd669.jpg\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h1>Aprenda e investigue: configure seu pr\u00f3prio honeypot<\/h1>\n<p>\nRecentemente, escrevi um breve guia sobre como <noindex><a rel=\"nofollow\" href=\"https:\/\/hackertarget.com\/cowrie-honeypot-ubuntu\/\">instalar o honeypot Cowrie em seu sistema<\/a><\/noindex>. Como mencionado anteriormente, neste caso, utilizamos o Digital Ocean VPS em Cingapura. Ap\u00f3s 24 horas de an\u00e1lise, o custo foi de apenas alguns centavos, e o tempo para configurar o sistema foi de 30 minutos.<\/p>\n<p>Em vez de executar o Cowrie na internet e capturar todo o ru\u00eddo, voc\u00ea pode se beneficiar de um honeypot na rede local. Basta configurar um alerta se houver solicita\u00e7\u00f5es para determinadas portas. Isso pode ser um invasor dentro da rede, um funcion\u00e1rio curioso ou uma varredura de vulnerabilidades.<\/p>\n<h1>Como resultado, obtemos um servi\u00e7o de \"monitoramento como servi\u00e7o\", automatizado na linha de produ\u00e7\u00e3o de integra\u00e7\u00e3o cont\u00ednua. O desenvolvedor ou testador precisa apenas definir a lista de m\u00e9tricas em um arquivo JSON, e tudo o mais acontece automaticamente. Obtemos um controle de qualidade transparente dos lan\u00e7amentos: todas as notifica\u00e7\u00f5es sobre desempenho, consumo de recursos ou regress\u00f5es arquitet\u00f4nicas.<\/h1>\n<p>\nAp\u00f3s observar as a\u00e7\u00f5es dos invasores por um dia, fica claro que n\u00e3o se pode identificar uma fonte espec\u00edfica de ataques em nenhuma organiza\u00e7\u00e3o, pa\u00eds ou mesmo sistema operacional.<\/p>\n<p>A ampla gama de fontes mostra que o ru\u00eddo de varredura \u00e9 constante e n\u00e3o est\u00e1 associado a uma origem espec\u00edfica. Qualquer um que trabalhe na internet deve garantir que seu sistema <b>tenha v\u00e1rios n\u00edveis de seguran\u00e7a<\/b>. Uma solu\u00e7\u00e3o comum e eficaz para <b>SSH<\/b> seria mover o servi\u00e7o para uma porta alta aleat\u00f3ria. Isso n\u00e3o elimina a necessidade de uma prote\u00e7\u00e3o rigorosa por senha e monitoramento, mas ao menos garante que os logs n\u00e3o ficam sobrecarregados com varreduras constantes. Conex\u00f5es em portas altas t\u00eam maior probabilidade de serem ataques direcionados, o que pode ser do seu interesse.<\/p>\n<p>Portas telnet frequentemente abertas est\u00e3o em roteadores ou em outros dispositivos, portanto n\u00e3o podem ser facilmente movidas para uma porta alta. <noindex><a rel=\"nofollow\" href=\"https:\/\/hackertarget.com\/nmap-online-port-scanner\/\">Informa\u00e7\u00f5es sobre todas as portas abertas<\/a><\/noindex> e <noindex><a rel=\"nofollow\" href=\"https:\/\/hackertarget.com\/domain-profiler\/\">superf\u00edcie de ataque<\/a><\/noindex> \u2014 \u00e9 a \u00fanica maneira de garantir que esses servi\u00e7os estejam protegidos por um firewall ou desativados. Sempre que poss\u00edvel, evite usar Telnet, pois esse protocolo n\u00e3o \u00e9 criptografado. Se for essencial, control\u00e1-lo de perto e utilizar senhas fortes \u00e9 imprescind\u00edvel.<br \/>\n<br \/>Fonte: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/436076\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0421\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0437\u0430 24 \u0447\u0430\u0441\u0430 \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 Digital Ocean \u0432 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435 \u041f\u0438\u0443-\u043f\u0438\u0443! \u041d\u0430\u0447\u043d\u0451\u043c \u0441\u0440\u0430\u0437\u0443 \u0441 \u043a\u0430\u0440\u0442\u044b \u0430\u0442\u0430\u043a \u041d\u0430\u0448\u0430 \u0441\u0443\u043f\u0435\u0440\u043a\u043b\u0430\u0441\u0441\u043d\u0430\u044f \u043a\u0430\u0440\u0442\u0430 \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0443\u043d\u0438\u043a\u0430\u043b\u044c\u043d\u044b\u0435 ASN, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0430\u043b\u0438\u0441\u044c \u043a \u043d\u0430\u0448\u0435\u043c\u0443 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0443 Cowrie \u0437\u0430 24 \u0447\u0430\u0441\u0430. \u0416\u0451\u043b\u0442\u044b\u0439 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u0435\u0442 SSH-\u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u043c, \u0430 \u043a\u0440\u0430\u0441\u043d\u044b\u0439\u00a0\u2014 Telnet. \u0422\u0430\u043a\u0438\u0435 \u0430\u043d\u0438\u043c\u0430\u0446\u0438\u0438 \u0447\u0430\u0441\u0442\u043e \u0432\u043f\u0435\u0447\u0430\u0442\u043b\u044f\u044e\u0442 \u0441\u043e\u0432\u0435\u0442 \u0434\u0438\u0440\u0435\u043a\u0442\u043e\u0440\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0432\u044b\u0431\u0438\u0442\u044c \u0431\u043e\u043b\u044c\u0448\u0435 \u0444\u0438\u043d\u0430\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u0438 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-30311","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0421\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0437\u0430 24 \u0447\u0430\u0441\u0430 \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 Digital Ocean \u0432 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435 \u041f\u0438\u0443-\u043f\u0438\u0443!\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/pt\/blog\/analiz-atak-na-hanipot-cowrie\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"pt_PT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u043d\u0430\u043b\u0438\u0437 \u0430\u0442\u0430\u043a \u043d\u0430 \u0445\u0430\u043d\u0438\u043f\u043e\u0442 Cowrie | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0421\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0437\u0430 24 \u0447\u0430\u0441\u0430 \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 Digital Ocean \u0432 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435 \u041f\u0438\u0443-\u043f\u0438\u0443!\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/pt\/blog\/analiz-atak-na-hanipot-cowrie\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T18:34:49+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T18:34:49+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47An\u00e1lise de ataques ao honeypot Cowrie | ProHoster","description":"Estat\u00edsticas de 24 horas ap\u00f3s a instala\u00e7\u00e3o do honeypot no n\u00f3 Digital Ocean em Cingapura Piu-piu!","canonical_url":"https:\/\/prohoster.info\/pt\/blog\/analiz-atak-na-hanipot-cowrie","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"pt_PT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u043d\u0430\u043b\u0438\u0437 \u0430\u0442\u0430\u043a \u043d\u0430 \u0445\u0430\u043d\u0438\u043f\u043e\u0442 Cowrie | ProHoster","og:description":"\u0421\u0442\u0430\u0442\u0438\u0441\u0442\u0438\u043a\u0430 \u0437\u0430 24 \u0447\u0430\u0441\u0430 \u043f\u043e\u0441\u043b\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u0445\u0430\u043d\u0438\u043f\u043e\u0442\u0430 \u043d\u0430 \u0443\u0437\u043b\u0435 Digital Ocean \u0432 \u0421\u0438\u043d\u0433\u0430\u043f\u0443\u0440\u0435 \u041f\u0438\u0443-\u043f\u0438\u0443!","og:url":"https:\/\/prohoster.info\/pt\/blog\/analiz-atak-na-hanipot-cowrie","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T18:34:49+00:00","article:modified_time":"2019-10-31T18:34:49+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"30311","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-21 00:36:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 03:37:27","updated":"2026-01-21 00:36:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/30311","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/comments?post=30311"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/posts\/30311\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/media?parent=30311"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/categories?post=30311"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/pt\/wp-json\/wp\/v2\/tags?post=30311"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}