コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2019/09/01 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2019/09/01分です。

特徴
Region：AP

HiSilicon DVR Devicesの脆弱性を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
を確認しました。

Region：US

ThinkPHPの脆弱性を狙うアクセス
を確認しました。

Region：EU

110[.]249[.]212[.]46に関する不正通信
123[.]125[.]114[.]144に関する不正通信
を確認しました。

他
アクセス数推移

AP：総アクセス数：29 (前日比：-16)
US：総アクセス数：27 (前日比：+16)
EU：総アクセス数：21 (前日比：+14)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Region：AP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 104.198.174.99 United States
2 112.87.34.138 China
4 118.184.218.78 China
4 120.204.202.112 China
1 138.185.109.71 Brazil
4 152.136.39.254 China
1 163.177.79.32 China
1 171.4.243.243 Thailand
4 180.101.249.129 China
1 197.232.18.101 Kenya
1 2.243.38.176 Germany
1 35.189.47.212 United States
1 35.232.18.196 United States
1 41.216.186.87 South Africa
1 87.78.111.190 Germany
1 93.170.116.1 Ukraine

UserAgent一覧

件数 UserAgent
4 -
4 Go-http-client/1.1
1 Mozilla/5.0
1 Mozilla/5.0 (iPhone; CPU iPhone OS 9_2 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13C75 Safari/601.1
1 Mozilla/5.0 (Linux; Android 6.0; Nexus 5X Build/MDB08L) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.124 Mobile Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
3 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36
1 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20120427 Firefox/15.0a1
12 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
1 SAMSUNG-SGH-E250/1.0 Profile/MIDP-2.0 Configuration/CLDC-1.1 UP.Browser/6.2.3.3.c.1.101 (GUI) MMP/2.0 (compatible; Googlebot-Mobile/2.1; http://www.google.com/bot.html)

リクエスト内容一覧

件数 Method Request Protocol
3 GET ../../mnt/custom/ProductDefinition HTTP
1 GET /phpmyadmin/ HTTP/1.1
4 GET /Security/users?auth=YWRtaW46MTEK HTTP/1.1
1 GET /shell?busybox HTTP/1.1
4 GET /TP/index.php HTTP/1.1
4 GET /TP/index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1 HTTP/1.1
4 GET /TP/public/index.php HTTP/1.1
1 OPTIONS / HTTP/1.0
2 OPTIONS / HTTP/1.1
4 POST /TP/index.php?s=captcha HTTP/1.1
1 \x03
Region:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 192.160.102.170 Canada
10 218.95.167.142 China
1 35.228.76.91 United States
10 39.135.1.157 China
1 41.216.186.87 South Africa
1 66.240.205.34 United States
3 77.247.181.165 Netherlands

UserAgent一覧

件数 UserAgent
2 -
2 Go-http-client/1.1
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0
1 Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.5; it; rv:1.9b4) Gecko/2008030317 Firefox/3.0b4
1 Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; he; rv:1.9.1b4pre) Gecko/20100405 Firefox/3.6.3plugin1
1 Mozilla/5.0 (Macintosh; U; PPC Mac OS X Mach-O; en-US; rv:1.8.1.4) Gecko/20070515 Firefox/2.0.4
1 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36
18 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)

リクエスト内容一覧

件数 Method Request Protocol
2 GET /elrekt.php HTTP/1.1
1 GET /.env HTTP/1.1
1 GET /.git/config HTTP/1.1
1 GET /.git/index HTTP/1.1
2 GET /html/public/index.php HTTP/1.1
2 GET /index.php HTTP/1.1
2 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1 HTTP/1.1
1 GET /.o3mJzT HTTP/1.1
2 GET /public/index.php HTTP/1.1
2 GET /thinkphp/html/public/index.php HTTP/1.1
2 GET /TP/html/public/index.php HTTP/1.1
2 GET /TP/index.php HTTP/1.1
2 GET /TP/public/index.php HTTP/1.1
1 Gh0st\xad
1 OPTIONS / HTTP/1.0
2 POST /index.php?s=captcha HTTP/1.1
1 \x03
Region:EU

送信元IPアドレス一覧

件数 送信元IPアドレス 国
3 110.249.212.46 China
1 113.57.114.40 China
1 123.138.77.52 China
1 123.145.2.169 China
1 124.235.138.13 China
1 125.118.0.142 China
1 125.84.180.53 China
1 175.152.28.77 China
1 182.101.49.155 China
1 185.82.202.181 Netherlands
1 221.11.60.157 China
1 221.213.75.134 China
1 35.232.18.196 United States
1 41.216.186.87 South Africa
1 58.248.200.155 China
2 59.36.132.222 China
1 66.240.205.34 United States
1 91.121.209.213 France

UserAgent一覧

件数 UserAgent
6 -
1 curl/7.19.7 (x86_64-redhat-linux-gnu) libcurl/7.19.7 NSS/3.13.1.0zlib/1.2.3 libidn/1.18 libssh2/1.2.2
1 Mozilla/5.01719037 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36
7 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36
1 Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1
1 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36
1 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36
3 PycURL/7.43.0 libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3

リクエスト内容一覧

件数 Method Request Protocol
1 CONNECT cn[.]bing[.]com:443 HTTP/1.1
2 CONNECT www[.]baidu[.]com:443 HTTP/1.1
1 CONNECT www[.]voanews[.]com:443 HTTP/1.1
1 GET /HNAP1/ HTTP/1.1
3 GET http://110[.]249[.]212[.]46/testget?q=23333&port=80 HTTP/1.1
1 GET http://boxun[.]com/ HTTP/1.1
1 GET http://www[.]123cha[.]com/ HTTP/1.1
1 GET http://www[.]baidu[.]com/ HTTP/1.1
1 GET http://www[.]epochtimes[.]com/ HTTP/1.1
1 GET http://www[.]ip[.]cn/ HTTP/1.1
1 GET http://www[.]minghui[.]org/ HTTP/1.1
1 GET http://www[.]rfa[.]org/english/ HTTP/1.1
1 GET http://www[.]wujieliulan[.]com/ HTTP/1.1
1 Gh0st\xad
1 HEAD http://123[.]125[.]114[.]144/ HTTP/1.1
1 OPTIONS / HTTP/1.0
1 \x03
1 \x16\x03\x01