@eyedeekay
&zzz
+R4SAS
+RN_
+Stormycloud
+T3s|4
+cumlord
+dr|z3d
+hagen
+mareki2p
+orignal
+postman
+qend-irc2p
+snex
Arch
BubbRubb
Daddy_
Danny
DeltaOreo
FreefallHeavens
Guest99
Irc2PGuest13210
Irc2PGuest20240
Irc2PGuest21940
Irc2PGuest22255
Irc2PGuest32330
Irc2PGuest74254
Irc2PGuest76033
Irc2PGuest78101
Onn4l7h
Onn4|7h
Over1
Sisyphus
Sleepy
SlippyJoe_
T3s|4_
Teeed
Uncrushed_
aargh2
ac9f_
acetone_
anontor2
b3t4f4c3___
dr4wd3
duanin2
erniee
eyedeekay_bnc
fus3r1
leopold
makoto
n1
nilbog-
noidea
onon_
poriori_
profetikla
r00tobo
rapidash
shiver_
solidx66_
thetia
u5657
uop23ip
vivid_reader56
w8rabbit
wodencafe2
x74a6
zelgomer
dr|z3d
two candidates for default url filtering.. also on rinse and repeat in my logs:
dr|z3d
> /server-status
dr|z3d
> /private_key
dr|z3d
I'm also seeing a random character url fairly regularly, e.g.:
dr|z3d
> /gkvoxjypwhfq
dr|z3d
> /tcpyjxbzmigl
dr|z3d
> /dqitwlrvxphz
dr|z3d
the following is a list of urls that appear to be part of the same scan, from multiple dests.. occasionally you'll see all of them at the same time in your logs:
dr|z3d
> /robots.txt
dr|z3d
> /products/cat
dr|z3d
> /products
dr|z3d
> /wp-users/
dr|z3d
> /wp-admin/
dr|z3d
> /wp-uploads/
dr|z3d
> /wp-content/
dr|z3d
> /wp-includes/
dr|z3d
> /wp-content/uploads/
dr|z3d
> /static
dr|z3d
> /img
dr|z3d
> /images
dr|z3d
> /uploads
dr|z3d
> /css
dr|z3d
> /styles
dr|z3d
> /style
dr|z3d
> /server-status
RN
Those are indeed what the wordpress scanner hits. I have a cron job to grep my jetty request log for any hit on wp-* and add that dest to my filter file.
albat
hey RN :)
RN
I have 11 destinations in the wordpress filter file
RN
the dests seem to persist
albat
RN? :/
RN
aloha albat :)
albat
how are you ?
RN
doing well. Follow me to #i2p-chat?
albat
sure