<![CDATA[Scan attack on VAV : mstshash=Administr]]>

# cat /var/log/nginx/access.log-* | grep "Administr" | awk '{print $1}' | sort -n | uniq -c
      2 45.227.254.156
      3 176.46.158.61
      2 193.24.211.48
      1 194.165.16.162
      1 194.165.16.164
      1 194.165.16.165
      1 194.165.16.167

Logs :
“\x03\x00\x00/*\xE0\x00\x00\x00\x00\x00Cookie: mstshash=Administr”

[MS-RDPBCGR]: Client X.224 Connection Request PDU

The following is an annotated dump of the X.224 Connection Request PDU (section 2.2.1.1). 00000000 03 00 00 2c 27 e0

(learn.microsoft.com)

]]>https://lemmy.cyber-neurones.org/topic/107/scan-attack-on-vav-mstshash-administrRSS for NodeThu, 30 Apr 2026 12:52:59 GMTFri, 12 Sep 2025 12:30:38 GMT60