ハニーポット(仮) 観測記録 2019/11/22分です。
特徴
Region：AP
クラウド環境のメタデータ情報を狙うアクセス
phpMyAdminに対するスキャン行為
AWS Security Scannerによるスキャン行為
ZmEuによるスキャン行為
18[.]179[.]20[.]5に関する不正通信
Gh0stRATのような動き
を確認しました。
Region：US
ThinkPHPの脆弱性を狙うアクセス
phpMyAdminに対するスキャン行為
112[.]124[.]42[.]80に関する不正通信
を確認しました。
Region：EU
Apache Struts 2の脆弱性(CVE-2017-5638)を狙うアクセス
HiSilicon DVR Devicesの脆弱性を狙うアクセス
Shenzhen TVT製品の脆弱性を狙うアクセス
phpMyAdminに対するスキャン行為
Gh0stRATのような動き
を確認しました。
他
アクセス数推移
AP：総アクセス数：61 (前日比：+7)
US：総アクセス数：31 (前日比：+13)
EU：総アクセス数：53 (前日比：+30)
都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。
Region：AP
送信元IPアドレス一覧
| 件数 | 送信元IPアドレス | 国 |
|---|---|---|
| 5 | 106.54.113.221 | China |
| 7 | 123.206.226.149 | China |
| 17 | 44.224.22.196 | United States |
| 17 | 44.225.84.206 | United States |
| 1 | 60.191.66.222 | China |
| 8 | 61.144.217.189 | China |
| 1 | 61.219.11.153 | Taiwan |
| 5 | 66.228.50.196 | United States |
UserAgent一覧
| 件数 | UserAgent |
|---|---|
| 27 | - |
| 14 | AWS Security Scanner |
| 1 | Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0) |
| 5 | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0 |
| 8 | Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6) |
| 6 | ZmEu |
リクエスト内容一覧
| 件数 | Method | Request | Protocol |
|---|---|---|---|
| 1 | - | ||
| 10 | CONNECT | 18[.]179[.]20[.]5:80 | HTTP/1.0 |
| 1 | GET | /elrekt.php | HTTP/1.1 |
| 1 | GET | /html/public/index.php | HTTP/1.1 |
| 1 | GET | HTTP/1.1 | |
| 2 | GET | http://169[.]254[.]169[.]254/ | HTTP/1.1 |
| 2 | GET | http://169[.]254[.]169[.]254/latest/dynamic/instance-identity/document | HTTP/1.1 |
| 2 | GET | http://example[.]com/ | HTTP/1.1 |
| 2 | GET | http://[::ffff:a9fe:a9fe]/ | HTTP/1.1 |
| 2 | GET | http://[::ffff:a9fe:a9fe]/latest/dynamic/instance-identity/document | HTTP/1.1 |
| 1 | GET | /index.php | HTTP/1.1 |
| 4 | GET | /latest/dynamic/instance-identity/document | HTTP/1.1 |
| 1 | GET | /login.action | HTTP/1.1 |
| 1 | GET | /login?from=%2F | HTTP/1.1 |
| 1 | GET | /manager/html | HTTP/1.1 |
| 1 | GET | /myadmin/scripts/setup.php | HTTP/1.1 |
| 1 | GET | /MyAdmin/scripts/setup.php | HTTP/1.1 |
| 2 | GET | /phpmyadmin/scripts/setup.php | HTTP/1.1 |
| 2 | GET | /phpMyAdmin/scripts/setup.php | HTTP/1.1 |
| 1 | GET | /pma/scripts/setup.php | HTTP/1.1 |
| 1 | GET | /public/index.php | HTTP/1.1 |
| 1 | GET | /sadad24 | HTTP/1.1 |
| 1 | GET | /thinkphp/html/public/index.php | HTTP/1.1 |
| 1 | GET | /TP/html/public/index.php | HTTP/1.1 |
| 1 | GET | /TP/index.php | HTTP/1.1 |
| 1 | GET | /TP/public/index.php | HTTP/1.1 |
| 1 | GET | /w00tw00t.at.blackhats.romanian.anti-sec:) | HTTP/1.1 |
| 1 | Gh0st\xad | ||
| 1 | HELP | ||
| 11 | \x16\x03\x01 | ||
| 1 | \x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc\n | ||
| 1 | \xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff\n |
Region:US
送信元IPアドレス一覧
| 件数 | 送信元IPアドレス | 国 |
|---|---|---|
| 1 | 104.197.91.229 | United States |
| 10 | 106.120.183.176 | China |
| 1 | 121.7.25.104 | Singapore |
| 2 | 130.211.254.102 | United States |
| 5 | 165.22.212.143 | United States |
| 1 | 185.172.110.221 | Netherlands |
| 1 | 45.227.255.100 | Panama |
| 1 | 46.88.51.150 | Germany |
| 1 | 60.191.52.254 | China |
| 1 | 61.219.11.153 | Taiwan |
| 1 | 85.93.20.134 | Germany |
| 5 | 88.99.102.229 | Germany |
| 1 | 89.245.27.197 | Germany |
UserAgent一覧
| 件数 | UserAgent |
|---|---|
| 13 | - |
| 1 | Go-http-client/1.1 |
| 1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36 |
| 5 | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0 |
| 9 | Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6) |
| 2 | python-requests/2.22.0 |
リクエスト内容一覧
| 件数 | Method | Request | Protocol |
|---|---|---|---|
| 1 | |||
| 1 | - | ||
| 1 | CONNECT | rdarmy[.]com:443 | HTTP/1.1 |
| 1 | GET | /axis2-admin | HTTP/1.1 |
| 1 | GET | /axis2/axis2-admin | HTTP/1.1 |
| 1 | GET | /elrekt.php | HTTP/1.1 |
| 1 | GET | /html/public/index.php | HTTP/1.1 |
| 1 | GET | /index.php | HTTP/1.1 |
| 1 | GET | /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1 | HTTP/1.1 |
| 1 | GET | /login.action | HTTP/1.1 |
| 1 | GET | /login?from=%2F | HTTP/1.1 |
| 1 | GET | /phpmyadmin/scripts/setup.php | HTTP/1.1 |
| 1 | GET | /phpMyAdmin/scripts/setup.php | HTTP/1.1 |
| 1 | GET | /public/index.php | HTTP/1.1 |
| 1 | GET | /sadad24 | HTTP/1.1 |
| 1 | GET | /thinkphp/html/public/index.php | HTTP/1.1 |
| 1 | GET | /TP/html/public/index.php | HTTP/1.1 |
| 1 | GET | /TP/index.php | HTTP/1.1 |
| 1 | GET | /TP/public/index.php | HTTP/1.1 |
| 3 | GET | /v1/agent/self | HTTP/1.1 |
| 1 | Gh0st\xad | ||
| 1 | HEAD | http://112[.]124[.]42[.]80:63435/ | HTTP/1.1 |
| 1 | HELP | ||
| 1 | POST | /index.php?s=captcha | HTTP/1.1 |
| 2 | \x03 | ||
| 1 | \x16\x03\x01 | ||
| 1 | \x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc | ||
| 1 | \xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff |
Region:EU
送信元IPアドレス一覧
| 件数 | 送信元IPアドレス | 国 |
|---|---|---|
| 1 | 113.176.64.135 | Vietnam |
| 8 | 116.255.226.242 | China |
| 2 | 128.201.76.22 | Brazil |
| 1 | 185.128.41.50 | Switzerland |
| 1 | 185.172.110.221 | Netherlands |
| 1 | 24.244.144.145 | Bahamas |
| 1 | 45.136.108.65 | Germany |
| 5 | 45.33.64.113 | United States |
| 30 | 49.233.189.6 | China |
| 1 | 61.219.11.153 | Taiwan |
| 1 | 85.14.245.149 | Germany |
| 1 | 92.53.90.84 | Russia |
UserAgent一覧
| 件数 | UserAgent |
|---|---|
| 41 | - |
| 1 | ApiTool |
| 1 | Java/1.8.0_131 |
| 2 | Mozilla/4.0 (compatible; MSIE 6.0; Windows 98) |
| 8 | Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2) |
リクエスト内容一覧
| 件数 | Method | Request | Protocol |
|---|---|---|---|
| 1 | |||
| 1 | - | ||
| 1 | GET | //console/login/LoginForm.jsp | HTTP/1.1 |
| 1 | GET | //dede/tpl.php | HTTP/1.1 |
| 1 | GET | /.env | HTTP/1.1 |
| 1 | GET | HTTP/1.1 | HTTP/1.1 |
| 1 | GET | //index.php | HTTP/1.1 |
| 1 | GET | //login.action | HTTP/1.1 |
| 1 | GET | /manager/html | HTTP/1.1 |
| 1 | GET | ../../mnt/custom/ProductDefinition | HTTP |
| 5 | GET | /muieblackcat | HTTP/1.1 |
| 5 | GET | //myadmin/scripts/setup.php | HTTP/1.1 |
| 5 | GET | //MyAdmin/scripts/setup.php | HTTP/1.1 |
| 5 | GET | //phpmyadmin/scripts/setup.php | HTTP/1.1 |
| 5 | GET | //phpMyAdmin/scripts/setup.php | HTTP/1.1 |
| 5 | GET | //pma/scripts/setup.php | HTTP/1.1 |
| 1 | GET | //public/index.php | HTTP/1.1 |
| 1 | GET | //showAnouncement.action | HTTP/1.1 |
| 1 | GET | //showcase.action | HTTP/1.1 |
| 1 | GET | //upload.action | HTTP/1.1 |
| 1 | Gh0st\xad | ||
| 1 | HELP | ||
| 1 | POST | /editBlackAndWhiteList | HTTP/1.1 |
| 3 | \x03 | ||
| 1 | \x16\x03\x01 | ||
| 1 | \x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc | ||
| 1 | \xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff |
