コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2019/08/28 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2019/08/28分です。

特徴
Region：AP

ThinkPHPの脆弱性を狙うアクセス
Pulse Secureを探索するアクセス
Polycomのデフォルトのマスタ設定ファイルに対するスキャン行為
phpMyAdminに対するスキャン行為
110[.]249[.]212[.]46に関する不正通信
112[.]124[.]42[.]80に関する不正通信
を確認しました。

Region：US

ThinkPHPの脆弱性を狙うアクセス
110[.]249[.]212[.]46に関する不正通信
5[.]188[.]210[.]101に関する不正通信
を確認しました。

Region：EU

Adobe ColdFusionの脆弱性を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Polycomのデフォルトのマスタ設定ファイルに対するスキャン行為
phpMyAdminに対するスキャン行為
110[.]249[.]212[.]46に関する不正通信
112[.]124[.]42[.]80に関する不正通信
123[.]125[.]114[.]144に関する不正通信
3[.]9[.]135[.]182に関する不正通信
を確認しました。

他
アクセス数推移

AP：総アクセス数：57 (前日比：+16)
US：総アクセス数：15 (前日比：-17)
EU：総アクセス数：45 (前日比：+26)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Region：AP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
4 104.238.111.193 United States
4 110.249.212.46 China
4 122.10.100.42 Hong Kong
3 123.206.31.120 China
1 165.22.168.78 United States
20 172.105.4.63 United States
1 172.105.88.27 United States
1 185.156.177.233 Russia
1 185.234.218.9 Ireland
1 216.244.66.231 United States
1 221.234.236.160 China
1 54.36.149.46 France
2 60.191.52.254 China
1 77.247.110.69 Estonia
12 89.248.174.39 Seychelles

UserAgent一覧

件数 UserAgent
22 -
2 Go-http-client/1.1
4 Mozilla 42
1 Mozilla/5.0 (compatible; AhrefsBot/6.1; +http://ahrefs.com/robot/)
1 Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/dotbot, help@moz.com)
2 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
12 Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0
1 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
5 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
4 python-requests/2.22.0

リクエスト内容一覧

件数 Method Request Protocol
2 GET /000000000000.cfg HTTP/1.1
2 GET /dana-na/nc/nc_gina_ver.txt HTTP/1.1
1 GET /evox/about HTTP/1.1
1 GET /HNAP1 HTTP/1.1
4 GET http://110[.]249[.]212[.]46/testget?q=23333&port=80 HTTP/1.1
2 GET /index.action HTTP/1.1
2 GET /login.action HTTP/1.1
1 GET /nmaplowercheck1566862290 HTTP/1.1
1 GET /phpMyAdmin/scripts/setup.php HTTP/1.1
2 GET /polycom/000000000000.cfg HTTP/1.1
2 GET /pv/000000000000.cfg HTTP/1.1
2 GET /pv/y000000000000.cfg HTTP/1.1
2 GET /robots.txt HTTP/1.1
2 GET /TP/index.php HTTP/1.1
1 GET /TP/index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1 HTTP/1.1
2 GET /TP/public/index.php HTTP/1.1
2 GET /y000000000000.cfg HTTP/1.1
2 GET /yealink/y000000000000.cfg HTTP/1.1
2 HEAD / HTTP/1.1
1 HEAD http://112[.]124[.]42[.]80:63435/ HTTP/1.1
1 HEAD /robots.txt HTTP/1.0
1 POST /sdk HTTP/1.1
2 POST /TP/index.php?s=captcha HTTP/1.1
1 \x03
16 \x16\x03\x01\x02
Region:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
10 104.225.235.138 United States
1 110.249.212.46 China
1 169.53.128.149 United States
1 5.188.210.101 Russia
2 77.247.110.69 Estonia

UserAgent一覧

件数 UserAgent
4 -
1 Go-http-client/1.1
1 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)

リクエスト内容一覧

件数 Method Request Protocol
1 GET /elrekt.php HTTP/1.1
1 GET /html/public/index.php HTTP/1.1
1 GET http://110[.]249[.]212[.]46/testget?q=23333&port=80 HTTP/1.1
1 GET http://5[.]188[.]210[.]101/echo.php HTTP/1.1
1 GET /index.php HTTP/1.1
1 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1 HTTP/1.1
1 GET /public/index.php HTTP/1.1
1 GET /thinkphp/html/public/index.php HTTP/1.1
1 GET /TP/html/public/index.php HTTP/1.1
1 GET /TP/index.php HTTP/1.1
1 GET /TP/public/index.php HTTP/1.1
2 HEAD /robots.txt HTTP/1.0
1 POST /index.php?s=captcha HTTP/1.1
1 \x16\x03\x02
Region:EU

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 106.47.41.85 China
5 110.249.212.46 China
1 111.162.137.203 China
1 111.224.234.48 China
10 113.125.59.234 China
1 113.128.104.36 China
1 113.140.251.33 China
1 113.96.223.207 China
1 116.252.0.189 China
1 116.252.2.61 China
1 123.145.29.6 China
1 124.235.138.186 China
1 193.169.254.11 Poland
1 213.128.88.99 Turkey
1 221.234.238.222 China
1 222.82.52.163 China
1 50.248.3.67 United States
1 60.191.52.254 China
1 77.247.110.129 Estonia
6 89.248.174.39 Seychelles
1 89.40.217.96 Sweden
6 95.110.227.199 Italy

UserAgent一覧

件数 UserAgent
13 -
1 Go-http-client/1.1
1 Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
7 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
2 Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1
6 Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0
1 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36
9 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
3 PycURL/7.43.0 libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3

リクエスト内容一覧

件数 Method Request Protocol
1 CONNECT cn[.]bing[.]com:443 HTTP/1.1
1 CONNECT www[.]baidu[.]com:443 HTTP/1.1
1 CONNECT www[.]voanews[.]com:443 HTTP/1.1
1 GET /000000000000.cfg HTTP/1.1
1 GET /CFIDE/administrator/ HTTP/1.1
1 GET /elrekt.php HTTP/1.1
1 GET /HNAP1/ HTTP/1.1
1 GET /html/public/index.php HTTP/1.1
5 GET http://110[.]249[.]212[.]46/testget?q=23333&port=80 HTTP/1.1
1 GET http://3[.]9[.]135[.]182/ HTTP/1.1
1 GET http://boxun[.]com/ HTTP/1.1
1 GET http://www[.]123cha[.]com/ HTTP/1.1
1 GET http://www[.]epochtimes[.]com/ HTTP/1.1
1 GET http://www[.]ip[.]cn/ HTTP/1.1
1 GET http://www[.]minghui[.]org/ HTTP/1.1
1 GET http://www[.]msftncsi[.]com/ncsi.txt HTTP/1.1
1 GET http://www[.]rfa[.]org/english/ HTTP/1.1
1 GET http://www[.]wujieliulan[.]com/ HTTP/1.1
1 GET /index.php HTTP/1.1
1 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1 HTTP/1.1
1 GET /manager/html HTTP/1.1
1 GET /muieblackcat HTTP/1.1
1 GET //myadmin/scripts/setup.php HTTP/1.1
1 GET //MyAdmin/scripts/setup.php HTTP/1.1
1 GET //phpmyadmin/scripts/setup.php HTTP/1.1
1 GET /phpmyadmin/scripts/setup.php HTTP/1.1
1 GET //phpMyAdmin/scripts/setup.php HTTP/1.1
1 GET //pma/scripts/setup.php HTTP/1.1
1 GET /polycom/000000000000.cfg HTTP/1.1
1 GET /public/index.php HTTP/1.1
1 GET /pv/000000000000.cfg HTTP/1.1
1 GET /pv/y000000000000.cfg HTTP/1.1
1 GET /thinkphp/html/public/index.php HTTP/1.1
1 GET /TP/html/public/index.php HTTP/1.1
1 GET /TP/index.php HTTP/1.1
1 GET /TP/public/index.php HTTP/1.1
1 GET /y000000000000.cfg HTTP/1.1
1 GET /yealink/y000000000000.cfg HTTP/1.1
1 HEAD http://112[.]124[.]42[.]80:63435/ HTTP/1.1
1 HEAD http://123[.]125[.]114[.]144/ HTTP/1.1
1 POST /index.php?s=captcha HTTP/1.1