コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2019/09/11 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2019/09/11分です。

特徴
Region：AP

ThinkPHPの脆弱性を狙うアクセス
phpMyAdminに対するスキャン行為
を確認しました。

Region：US

AVTECH製品の脆弱性を狙うアクセス
HiSilicon DVR Devicesの脆弱性を狙うアクセス
Polycomのデフォルトのマスタ設定ファイルに対するスキャン行為 5[.]188[.]210[.]101に関する不正アクセス
を確認しました。
YesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHX
という調査の動きも確認しました。

Region：EU

ThinkPHPの脆弱性を狙うアクセス
Polycomのデフォルトのマスタ設定ファイルに対するスキャン行為
を確認しました。

他
アクセス数推移

AP：総アクセス数：51 (前日比：+22)
US：総アクセス数：125 (前日比：+100)
EU：総アクセス数：15 (前日比：-18)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Region：AP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 113.173.236.56 Vietnam
4 130.61.56.210 United States
8 150.109.59.189 Singapore
1 158.58.135.58 Russia
1 172.104.242.173 United States
5 185.100.87.190 Romania
5 185.100.87.245 Romania
5 185.100.87.246 Romania
1 186.19.236.44 Argentina
4 198.20.70.114 United States
4 47.102.200.248 China
1 66.240.205.34 United States
1 66.249.73.195 United States
1 92.85.152.73 Romania
2 94.20.65.21 Azerbaijan
2 99.116.67.202 United States

UserAgent一覧

件数 UserAgent
10 -
2 Go-http-client/1.1
8 Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)
1 Mozilla/5.0
1 Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
15 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
2 Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
6 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
1 python-requests/2.10.0

リクエスト内容一覧

件数 Method Request Protocol
1 -
3 GET /evox/about HTTP/1.1
1 GET /favicon.ico HTTP/1.1
3 GET /HNAP1 HTTP/1.1
1 GET /index.php HTTP/1.1
5 GET ../../mnt/custom/ProductDefinition HTTP
1 GET /nmaplowercheck1568072548 HTTP/1.1
1 GET /nmaplowercheck1568076774 HTTP/1.1
1 GET /nmaplowercheck1568121284 HTTP/1.1
4 GET /phpmyadmin HTTP/1.1
4 GET /phpmyadmin/ HTTP/1.1
1 GET /phpmyadmin/index.php HTTP/1.1
2 GET /robots.txt HTTP/1.1
1 GET /sitemap.xml HTTP/1.1
2 GET /TP/index.php HTTP/1.1
2 GET /TP/index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1 HTTP/1.1
2 GET /TP/public/index.php HTTP/1.1
1 GET /webdav/ HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
1 Gh0st\xad
3 HEAD / HTTP/1.1
3 POST /sdk HTTP/1.1
2 POST /TP/index.php?s=captcha HTTP/1.1
Region:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 123.24.165.47 Vietnam
1 125.59.115.17 Hong Kong
6 137.226.113.10 Germany
6 175.152.30.96 China
2 177.82.51.237 Brazil
1 179.234.106.167 Brazil
1 201.255.100.71 Argentina
1 221.185.247.136 Japan
1 5.188.210.101 Russia
4 62.173.140.192 Russia
101 68.66.243.37 United States

UserAgent一覧

件数 UserAgent
13 -
6 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36 Scanning for research (researchscan.comsys.rwth-aachen.de)
101 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
1 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
4 Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0

リクエスト内容一覧

件数 Method Request Protocol
1 GET /000000000000.cfg HTTP/1.1
1 GET /cgi-bin/nobody/Machine.cgi?action=get_capability HTTP/1.1
1 GET /cgi-bin/user/Config.cgi?.cab&action=get&category=Account.* HTTP/1.1
1 GET /current_config/passwd HTTP/1.1
1 GET /device_description.xml HTTP/1.1
1 GET http://5[.]188[.]210[.]101/echo.php HTTP/1.1
1 GET /login/login.html HTTP/1.1
7 GET ../../mnt/custom/ProductDefinition HTTP
101 GET /phpmyadmin/ HTTP/1.1
1 GET /provisioning/000000000000.cfg HTTP/1.1
1 GET /provisioning/y000000000000.cfg HTTP/1.1
1 GET /winbox.png HTTP/1.1
1 GET /y000000000000.cfg HTTP/1.1
6 GET /YesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScanningForResearchPurposePleaseHaveALookAtTheUserAgentTHXYesThisIsAReallyLongRequestURLbutWeAreDoingItOnPurposeWeAreScann HTTP/1.1
Region:EU

送信元IPアドレス一覧

件数 送信元IPアドレス 国
10 140.116.249.129 Taiwan
1 172.104.242.173 United States
4 62.173.149.190 Russia

UserAgent一覧

件数 UserAgent
1 -
1 Go-http-client/1.1
4 Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0
9 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 GET /000000000000.cfg HTTP/1.1
1 GET /elrekt.php HTTP/1.1
1 GET /html/public/index.php HTTP/1.1
1 GET /index.php HTTP/1.1
1 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1 HTTP/1.1
1 GET /provisioning/000000000000.cfg HTTP/1.1
1 GET /provisioning/y000000000000.cfg HTTP/1.1
1 GET /public/index.php HTTP/1.1
1 GET /thinkphp/html/public/index.php HTTP/1.1
1 GET /TP/html/public/index.php HTTP/1.1
1 GET /TP/index.php HTTP/1.1
1 GET /TP/public/index.php HTTP/1.1
1 GET /y000000000000.cfg HTTP/1.1
1 POST /index.php?s=captcha HTTP/1.1