IRCaBot 2.1.0
GPLv3 © acetone, 2021-2022
#i2p-dev
/2022/05/11
@eyedeekay
&zzz
+R4SAS
+RN
+T3s|4
+acetone
+altonen
+dr|z3d
+hagen
+hk
+orignal
+postman
+qend-irc2p
+snex
+weko
+wodencafe
+y2kboy23
Arch
BubbRubb1
Daddy
Daddy_1
Danny
DeltaOreo
FreeB
FreefallHeavens
HowardPlayzOfAdmin
Irc2PGuest31631
Irc2PGuest41581
Irc2PGuest92548
Irc2PGuest95056
Leopold
Onn4l7h
Onn4|7h
Sisyphus
Sleepy
SlippyJoe_
StormyCloud_
T3s|4_
T3s|4__
Teeed
ardu
b3t4f4c3___
bak83_
boonst
defaultnick
dr4wd3_
eyedeekay_bnc
guest7621
not_bob_afk
not_human_
poriori_
profetikla
r00tobo
rapidash
shiver_
solidx66_
thetia
tr
u5657
uop23ip
w8rabbit
x74a6
dr|z3d two candidates for default url filtering.. also on rinse and repeat in my logs:
dr|z3d > /server-status
dr|z3d > /private_key
dr|z3d I'm also seeing a random character url fairly regularly, e.g.:
dr|z3d > /gkvoxjypwhfq
dr|z3d > /tcpyjxbzmigl
dr|z3d > /dqitwlrvxphz
dr|z3d the following is a list of urls that appear to be part of the same scan, from multiple dests.. occasionally you'll see all of them at the same time in your logs:
dr|z3d > /robots.txt
dr|z3d > /products/cat
dr|z3d > /products
dr|z3d > /wp-users/
dr|z3d > /wp-admin/
dr|z3d > /wp-uploads/
dr|z3d > /wp-content/
dr|z3d > /wp-includes/
dr|z3d > /wp-content/uploads/
dr|z3d > /static
dr|z3d > /img
dr|z3d > /images
dr|z3d > /uploads
dr|z3d > /css
dr|z3d > /styles
dr|z3d > /style
dr|z3d > /server-status
RN Those are indeed what the wordpress scanner hits. I have a cron job to grep my jetty request log for any hit on wp-* and add that dest to my filter file.
albat hey RN :)
RN I have 11 destinations in the wordpress filter file
RN the dests seem to persist
albat RN? :/
RN aloha albat :)
albat how are you ?
RN doing well. Follow me to #i2p-chat?
albat sure