blob: f95beceaa11bea67846f2f26fc41637b34bcc341 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
|
# Notable HTTP URL Paths Observed (Honeylabs)
# VPN/Remote Access Portal Probing
/dana-na/auth/url_default/welcome.cgi -- Pulse Secure VPN (AEZA, 138.124.51.186)
/sslvpnLogin.html -- SSL VPN portal (AEZA, 138.124.51.186)
/global-protect/login.esp -- Palo Alto GlobalProtect (AEZA, 138.124.51.186)
/remote/login -- Remote access portal (AEZA, 138.124.51.186)
/+CSCOE+/logon.html -- Cisco VPN (AEZA, 138.124.51.186)
/RDWeb/Pages/ -- Microsoft RD Web Access (AEZA, 138.124.51.186)
# General Login Probing
/login -- Generic login page (AEZA)
/Login/Login -- Generic login page variant (AEZA)
/cgi/login -- CGI login (AEZA)
/my.policy -- Policy page probe (AEZA)
# Remote Desktop / Guacamole
/guacamole/ -- Apache Guacamole (AEZA, 138.124.51.186)
# WinRM
/wsman?PSVersion=5.1.19041.1 -- WinRM probing (KAOPU-HK, 154.90.37.55)
# 3x-ui Proxy Panel
/assets/login-J3fs_cbU.js -- 3x-ui panel assets (AEZA, 138.124.51.186:2053)
/assets/vendor-antd-B5BXDqMa.css -- 3x-ui UI framework (AEZA)
|
