ハニーポット(仮) 観測記録 2020/05/06分です。
特徴
Location：JP
DrayTek製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
クラウド環境のメタデータ情報を狙うアクセス
AWS Security Scannerによるスキャン行為
polaris botnetによるスキャン行為
XTCによるスキャン行為
XTC BOTNETによるスキャン行為
zgrabによるスキャン行為
Apache Tomcatへのスキャン行為
phpMyAdminへのスキャン行為
18[.]179[.]20[.]5に関する不正通信
163[.]172[.]88[.]110に関する不正通信
UserAgentがHello, Worldであるアクセス
を確認しました。
Location：US
XTCによるスキャン行為
zgrabによるスキャン行為
ZmEuによるスキャン行為
phpMyAdminへのスキャン行為
163[.]172[.]88[.]110に関する不正通信
を確認しました。
Location：UK
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Nmap Scripting Engineによるスキャン行為
XTCによるスキャン行為
zgrabによるスキャン行為
Apache Tomcatへのスキャン行為
163[.]172[.]88[.]110に関する不正通信
5[.]188[.]210[.]101に関する不正通信
を確認しました。
Location：SG
ThinkPHPの脆弱性を狙うアクセス
zgrabによるスキャン行為
phpMyAdminへのスキャン行為
163[.]172[.]88[.]110に関する不正通信
を確認しました。
他
アクセス数推移
JP：総アクセス数：78 (前日比：+5)
US：総アクセス数：20 (前日比：-37)
UK：総アクセス数：40 (前日比：-17)
SG：総アクセス数：134 (前日比：+106)
都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。
Location:JP
送信元IPアドレス一覧
| 件数 | 送信元IPアドレス | 国 |
|---|---|---|
| 8 | 27.223.105.66 | China |
| 1 | 31.15.187.107 | Slovenia |
| 34 | 44.224.22.196 | United States |
| 2 | 45.14.151.246 | Romania |
| 8 | 47.105.98.80 | China |
| 2 | 80.82.78.104 | Netherlands |
| 1 | 83.13.208.170 | Poland |
| 2 | 103.10.208.230 | India |
| 1 | 105.159.249.53 | Morocco |
| 1 | 108.238.143.30 | United States |
| 1 | 112.17.166.114 | China |
| 4 | 156.236.70.208 | United States |
| 2 | 159.65.121.162 | United States |
| 1 | 159.203.15.10 | United States |
| 1 | 162.243.144.69 | United States |
| 1 | 165.22.104.47 | United States |
| 1 | 178.128.238.52 | Canada |
| 1 | 183.91.4.97 | Vietnam |
| 1 | 185.163.109.66 | Romania |
| 1 | 186.101.230.155 | Ecuador |
| 1 | 190.140.0.59 | Panama |
| 1 | 193.118.53.202 | Germany |
| 1 | 197.232.1.182 | Kenya |
| 1 | 223.149.248.253 | China |
UserAgent一覧
| 件数 | UserAgent |
|---|---|
| 23 | - |
| 14 | AWS Security Scanner |
| 2 | Go-http-client/1.1 |
| 2 | Hello, World |
| 1 | Mozilla/5.0 |
| 1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 |
| 1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36 OPR/52.0.2871.64 |
| 16 | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0 |
| 4 | Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0 |
| 1 | Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6) |
| 2 | Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0 |
| 1 | Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0) |
| 2 | Mozilla/5.0 zgrab/0.x |
| 2 | Project25499 Scanner (opt-out@project25499.com) |
| 3 | XTC |
| 2 | XTC BOTNET |
| 1 | polaris botnet |
リクエスト内容一覧
| 件数 | Method | Request | Protocol |
|---|---|---|---|
| 10 | \x16\x03\x01 | ||
| 10 | CONNECT | 18[.]179[.]20[.]5:80 | HTTP/1.0 |
| 1 | GET | /TP/public/index.php | HTTP/1.1 |
| 1 | GET | /Telerik.Web.UI.WebResource.axd?type=rau | HTTP/1.1 |
| 1 | GET | /adv,/cgi-bin/weblogin.cgi?username=admin%27%3Bls%20%23&password=asdf | HTTP/1.1 |
| 1 | GET | /api/v3/time | HTTP/1.1 |
| 2 | GET | /cgi-bin/test-cgi | HTTP/1.1 |
| 2 | GET | /console | HTTP/1.1 |
| 2 | GET | /horde/imp/test.php | HTTP/1.1 |
| 4 | GET | /index.php | HTTP/1.1 |
| 4 | GET | /latest/dynamic/instance-identity/document | HTTP/1.1 |
| 2 | GET | /login.action | HTTP/1.1 |
| 2 | GET | /login/do_login | HTTP/1.1 |
| 2 | GET | /login?from=0.000000 | HTTP/1.1 |
| 1 | GET | /manager/html | HTTP/1.1 |
| 1 | GET | /news.php?type=0&time=22:43:23 | HTTP/1.1 |
| 2 | GET | /phpMyAdmin/scripts/setup.php | HTTP/1.1 |
| 2 | GET | /phpmyadmin/index.php | HTTP/1.1 |
| 2 | GET | /phpmyadmin/scripts/setup.php | HTTP/1.1 |
| 1 | GET | /portal/redlion | HTTP/1.1 |
| 1 | GET | /robots.txt | HTTP/1.1 |
| 1 | GET | /stager32 | HTTP/1.1 |
| 1 | GET | /stager64 | HTTP/1.1 |
| 2 | GET | http://[::ffff:a9fe:a9fe]/ | HTTP/1.1 |
| 2 | GET | http://[::ffff:a9fe:a9fe]/latest/dynamic/instance-identity/document | HTTP/1.1 |
| 2 | GET | http[:]//163[.]172[.]88[.]110:41298/pass | HTTP/1.1 |
| 2 | GET | http[:]//169[.]254[.]169[.]254/ | HTTP/1.1 |
| 2 | GET | http[:]//169[.]254[.]169[.]254/latest/dynamic/instance-identity/document | HTTP/1.1 |
| 2 | GET | http[:]//example[.]com/ | HTTP/1.1 |
| 2 | POST | /GponForm/diag_Form?images/ | HTTP/1.1 |
| 1 | POST | /boaform/admin/formPing | HTTP/1.1 |
| 5 | POST | /cgi-bin/mainfunction.cgi | HTTP/1.1 |
| 2 | POST | /goform/webLogin | HTTP/1.1 |
Location:US
送信元IPアドレス一覧
| 件数 | 送信元IPアドレス | 国 |
|---|---|---|
| 2 | 45.14.151.246 | Romania |
| 1 | 45.136.108.20 | Germany |
| 1 | 77.41.123.213 | Russia |
| 1 | 80.82.78.104 | Netherlands |
| 6 | 110.52.140.106 | China |
| 1 | 128.199.36.252 | Singapore |
| 1 | 162.243.137.7 | United States |
| 1 | 162.243.138.167 | United States |
| 1 | 172.104.242.173 | United States |
| 1 | 173.12.86.70 | United States |
| 1 | 178.128.238.52 | Canada |
| 1 | 193.118.53.202 | Germany |
| 2 | 195.54.160.77 | Russia |
UserAgent一覧
| 件数 | UserAgent |
|---|---|
| 5 | - |
| 2 | Go-http-client/1.1 |
| 1 | Mozilla/5.0 |
| 1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 Safari/605.1.15 |
| 1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 |
| 1 | Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0 |
| 2 | Mozilla/5.0 zgrab/0.x |
| 1 | XTC |
| 6 | ZmEu |
リクエスト内容一覧
| 件数 | Method | Request | Protocol |
|---|---|---|---|
| 1 | - | ||
| 3 | \x03 | ||
| 1 | GET | /MyAdmin/scripts/setup.php | HTTP/1.1 |
| 1 | GET | /Telerik.Web.UI.WebResource.axd?type=rau | HTTP/1.1 |
| 1 | GET | /adv,/cgi-bin/weblogin.cgi?username=admin%27%3Bls%20%23&password=asdf | HTTP/1.1 |
| 1 | GET | /hudson | HTTP/1.1 |
| 1 | GET | /index.php | HTTP/1.1 |
| 1 | GET | /myadmin/scripts/setup.php | HTTP/1.1 |
| 1 | GET | /news.php?type=0&time=02:49:38 | HTTP/1.1 |
| 1 | GET | /phpMyAdmin/scripts/setup.php | HTTP/1.1 |
| 1 | GET | /phpmyadmin/scripts/setup.php | HTTP/1.1 |
| 1 | GET | /pma/scripts/setup.php | HTTP/1.1 |
| 1 | GET | /portal/redlion | HTTP/1.1 |
| 1 | GET | /w00tw00t.at.blackhats.romanian.anti-sec:) | HTTP/1.1 |
| 2 | GET | http[:]//163[.]172[.]88[.]110:41298/pass | HTTP/1.1 |
| 1 | POST | /cgi-bin/mainfunction.cgi | HTTP/1.1 |
| 1 | POST | /goform/webLogin | HTTP/1.1 |
Location:UK
送信元IPアドレス一覧
| 件数 | 送信元IPアドレス | 国 |
|---|---|---|
| 1 | 2.50.51.176 | United Arab Emirates |
| 3 | 5.101.0.209 | Russia |
| 1 | 5.188.210.101 | Russia |
| 3 | 36.103.229.37 | China |
| 1 | 45.14.45.2 | United States |
| 2 | 45.14.151.246 | Romania |
| 1 | 64.225.100.105 | United States |
| 2 | 80.82.68.17 | Netherlands |
| 2 | 80.82.78.104 | Netherlands |
| 1 | 95.110.7.106 | Russia |
| 1 | 95.213.177.123 | Russia |
| 2 | 95.213.177.124 | Russia |
| 3 | 95.213.177.125 | Russia |
| 1 | 104.211.76.20 | United States |
| 3 | 132.145.49.191 | United States |
| 1 | 159.65.10.25 | United States |
| 1 | 162.243.137.6 | United States |
| 1 | 162.243.137.221 | United States |
| 1 | 162.243.144.161 | United States |
| 1 | 177.11.42.35 | Brazil |
| 1 | 185.128.41.50 | Switzerland |
| 1 | 186.101.230.155 | Ecuador |
| 1 | 193.118.53.194 | Germany |
| 2 | 195.54.160.77 | Russia |
| 2 | 200.94.240.164 | Brazil |
| 1 | 201.142.204.200 | Mexico |
UserAgent一覧
| 件数 | UserAgent |
|---|---|
| 4 | - |
| 2 | Go-http-client/1.1 |
| 1 | Java/1.8.0_131 |
| 6 | Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0) |
| 5 | Mozilla/5.0 |
| 1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.100 Safari/537.36 |
| 1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 |
| 3 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 |
| 1 | Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36 |
| 1 | Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36 OPR/52.0.2871.99 |
| 3 | Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6) |
| 2 | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36 |
| 1 | Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0 |
| 3 | Mozilla/5.0 (compatible; Nmap Scripting Engine; https://nmap.org/book/nse.html) |
| 3 | Mozilla/5.0 zgrab/0.x |
| 3 | XTC |
リクエスト内容一覧
| 件数 | Method | Request | Protocol |
|---|---|---|---|
| 2 | \x03 | ||
| 1 | GET | ../../proc/ HTTP | |
| 1 | GET | /HNAP1 | HTTP/1.1 |
| 1 | GET | /TP/index.php | HTTP/1.1 |
| 1 | GET | /TP/public/index.php | HTTP/1.1 |
| 1 | GET | /Telerik.Web.UI.WebResource.axd?type=rau | HTTP/1.1 |
| 1 | GET | /adv,/cgi-bin/weblogin.cgi?username=admin%27%3Bls%20%23&password=asdf | HTTP/1.1 |
| 1 | GET | /favicon.ico | HTTP/1.1 |
| 1 | GET | /hudson | HTTP/1.1 |
| 2 | GET | /manager/html | HTTP/1.1 |
| 1 | GET | /news.php?type=0&time=17:56:07 | HTTP/1.1 |
| 1 | GET | /news.php?type=0&time=20:30:11 | HTTP/1.1 |
| 1 | GET | /nmaplowercheck1588629109 | HTTP/1.1 |
| 1 | GET | /portal/redlion | HTTP/1.1 |
| 1 | GET | /robots.txt | HTTP/1.1 |
| 1 | GET | /thinkphp/html/public/index.php | HTTP/1.1 |
| 1 | GET | /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | HTTP/1.1 |
| 2 | GET | http[:]//163[.]172[.]88[.]110:41298/pass | HTTP/1.1 |
| 1 | GET | http[:]//5[.]188[.]210[.]101/echo.php | HTTP/1.1 |
| 1 | HEAD | /robots.txt | HTTP/1.0 |
| 1 | POST | /api/jsonws/invoke | HTTP/1.1 |
| 3 | POST | /cgi-bin/mainfunction.cgi | HTTP/1.1 |
| 5 | POST | /goform/webLogin | HTTP/1.1 |
| 1 | POST | /sdk | HTTP/1.1 |
| 1 | POST | /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | HTTP/1.1 |
| 1 | POST | http[:]//check[.]proxyradar[.]com/azenv.php?auth=158861824917&a=PSCMN&i=2224112162&p=80 | HTTP/1.1 |
| 1 | POST | http[:]//check[.]proxyradar[.]com/azenv.php?auth=158863442603&a=PSCMN&i=2224112162&p=80 | HTTP/1.1 |
| 1 | POST | http[:]//check[.]proxyradar[.]com/azenv.php?auth=158865120487&a=PSCMN&i=2224112162&p=80 | HTTP/1.1 |
| 1 | POST | http[:]//check[.]proxyradar[.]com/azenv.php?auth=158866751235&a=PSCMN&i=2224112162&p=80 | HTTP/1.1 |
| 1 | POST | http[:]//check[.]proxyradar[.]com/azenv.php?auth=158868378765&a=PSCMN&i=2224112162&p=80 | HTTP/1.1 |
| 1 | POST | http[:]//check[.]proxyradar[.]com/azenv.php?auth=158870018683&a=PSCMN&i=2224112162&p=80 | HTTP/1.1 |
Location:SG
送信元IPアドレス一覧
| 件数 | 送信元IPアドレス | 国 |
|---|---|---|
| 1 | 5.101.0.209 | Russia |
| 1 | 45.5.36.104 | Brazil |
| 2 | 45.14.151.246 | Romania |
| 1 | 80.82.78.104 | Netherlands |
| 2 | 87.251.75.254 | Russia |
| 1 | 92.63.194.30 | Russia |
| 101 | 114.27.45.85 | Taiwan |
| 1 | 120.29.157.118 | Indonesia |
| 10 | 129.204.106.181 | China |
| 1 | 151.76.82.243 | Italy |
| 1 | 161.35.65.5 | United States |
| 1 | 162.243.145.45 | United States |
| 1 | 177.66.71.111 | Brazil |
| 1 | 178.128.238.52 | Canada |
| 1 | 193.118.53.194 | Germany |
| 8 | 201.245.179.123 | Colombia |
UserAgent一覧
| 件数 | UserAgent |
|---|---|
| 4 | - |
| 3 | Go-http-client/1.1 |
| 4 | Mozilla/5.0 |
| 101 | Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36 |
| 1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36 OPR/46.0.2597.57 |
| 1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 |
| 1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 |
| 8 | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0 |
| 9 | Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6) |
| 1 | Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0 |
| 1 | Mozilla/5.0 zgrab/0.x |
リクエスト内容一覧
| 件数 | Method | Request | Protocol |
|---|---|---|---|
| 3 | \x03 | ||
| 1 | GET | /TP/html/public/index.php | HTTP/1.1 |
| 1 | GET | /TP/index.php | HTTP/1.1 |
| 1 | GET | /TP/public/index.php | HTTP/1.1 |
| 1 | GET | /Telerik.Web.UI.WebResource.axd?type=rau | HTTP/1.1 |
| 1 | GET | /adv,/cgi-bin/weblogin.cgi?username=admin%27%3Bls%20%23&password=asdf | HTTP/1.1 |
| 1 | GET | /cgi-bin/test-cgi | HTTP/1.1 |
| 1 | GET | /console | HTTP/1.1 |
| 1 | GET | /elrekt.php | HTTP/1.1 |
| 1 | GET | /horde/imp/test.php | HTTP/1.1 |
| 1 | GET | /html/public/index.php | HTTP/1.1 |
| 2 | GET | /index.php | HTTP/1.1 |
| 1 | GET | /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1 | HTTP/1.1 |
| 1 | GET | /login.action | HTTP/1.1 |
| 1 | GET | /login/do_login | HTTP/1.1 |
| 1 | GET | /login?from=0.000000 | HTTP/1.1 |
| 1 | GET | /news.php?type=0&time=17:28:48 | HTTP/1.1 |
| 1 | GET | /phpMyAdmin/scripts/setup.php | HTTP/1.1 |
| 101 | GET | /phpmyadmin/ | HTTP/1.1 |
| 1 | GET | /phpmyadmin/scripts/setup.php | HTTP/1.1 |
| 1 | GET | /portal/redlion | HTTP/1.1 |
| 1 | GET | /public/index.php | HTTP/1.1 |
| 1 | GET | /shell?busybox | HTTP/1.1 |
| 1 | GET | /thinkphp/html/public/index.php | HTTP/1.1 |
| 2 | GET | http[:]//163[.]172[.]88[.]110:41298/pass | HTTP/1.1 |
| 3 | POST | /goform/webLogin | HTTP/1.1 |
| 1 | POST | /index.php?s=captcha | HTTP/1.1 |
| 1 | POST | /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php | HTTP/1.1 |
