コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2020/07/03 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2020/07/03分です。

特徴
Location：JP

GPONルータの脆弱性(CVE-2018-10561)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
クラウド環境のメタデータ情報を狙うアクセス
AWS Security Scannerによるスキャン行為
Apache Solrへのスキャン行為
phpMyAdminへのスキャン行為
18[.]179[.]20[.]5に関する不正通信
UserAgentがHello, Worldであるアクセス
を確認しました。

Location：US

DrayTek製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
XTCによるスキャン行為
zgrabによるスキャン行為
Apache Solrへのスキャン行為
を確認しました。

Location：UK

DrayTek製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
XTCによるスキャン行為
zgrabによるスキャン行為
Apache Solrへのスキャン行為
Apache Tomcatへのスキャン行為
を確認しました。

Location：SG

GPONルータの脆弱性を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
zgrabによるスキャン行為
Apache Solrへのスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, Worldであるアクセス
を確認しました。

他
アクセス数推移

JP：総アクセス数：165 (前日比：+74)
US：総アクセス数：37 (前日比：-140)
UK：総アクセス数：30 (前日比：-29)
SG：総アクセス数：155 (前日比：+117)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 13.65.81.19 United States
1 39.107.238.8 China
1 42.115.42.161 Cambodia
34 44.225.84.206 United States
1 45.177.109.210 Colombia
1 45.185.32.137 Brazil
1 45.201.205.200 Cambodia
1 49.81.92.63 China
1 51.141.35.106 United Kingdom
1 54.223.233.135 China
1 61.160.236.86 China
1 66.160.175.167 United States
1 85.217.168.15 Bulgaria
1 101.53.142.43 India
1 103.78.221.161 India
1 103.214.15.40 Philippines
1 114.129.22.130 Indonesia
1 115.70.203.83 Australia
101 123.101.168.111 China
1 129.152.43.76 United States
1 132.145.111.59 United States
1 150.136.210.90 United States
1 185.202.1.204 Russia
7 195.54.160.135 Russia
1 203.34.152.144 China
1 203.211.143.85 Singapore

UserAgent一覧

件数 UserAgent
39 -
14 AWS Security Scanner
1 Hello, World
1 Java/1.8.0_251
1 Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3; KB974488)
101 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
7 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 curl/7.29.0

リクエスト内容一覧

件数 Method Request Protocol
1 \x03
21 \x16\x03\x01
10 CONNECT 18[.]179[.]20[.]5:80 HTTP/1.0
1 CONNECT www[.]google[.]com/:443 HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /Public/home/appjs/Index.js HTTP/1.1
7 GET /admin/login.asp HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP HTTP/1.1
4 GET /latest/dynamic/instance-identity/document HTTP/1.1
101 GET /phpmyadmin/ HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 GET http://[::ffff:a9fe:a9fe]/ HTTP/1.1
2 GET http://[::ffff:a9fe:a9fe]/latest/dynamic/instance-identity/document HTTP/1.1
2 GET http[:]//169[.]254[.]169[.]254/ HTTP/1.1
2 GET http[:]//169[.]254[.]169[.]254/latest/dynamic/instance-identity/document HTTP/1.1
2 GET http[:]//example[.]com/ HTTP/1.1
1 HEAD / HTTP/1.1
1 POST /GponForm/diag_Form?images/ HTTP/1.1
2 POST /api/jsonws/invoke HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 42.115.70.160 Cambodia
1 42.115.105.249 Cambodia
1 45.225.176.76 Brazil
1 51.235.146.211 Saudi Arabia
1 61.12.91.210 India
1 74.102.39.43 United States
1 94.176.158.16 Romania
1 103.121.29.170 Pakistan
1 103.130.70.19 India
1 103.214.137.229 India
1 115.96.145.100 India
1 116.62.147.109 China
1 121.31.14.133 China
1 122.103.135.235 Japan
1 128.14.209.226 United States
1 129.144.62.179 United States
1 129.144.224.27 United States
1 129.150.72.6 United States
1 129.213.152.224 United States
1 130.61.37.130 United States
1 130.61.83.191 United States
1 144.21.67.43 Sweden
1 150.136.210.90 United States
1 151.80.34.219 Italy
1 162.243.131.176 United States
1 167.99.2.115 United States
1 183.131.51.207 China
1 190.128.154.222 Paraguay
1 192.241.217.195 United States
8 195.54.160.135 Russia

UserAgent一覧

件数 UserAgent
23 -
1 Mozilla/5.0
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
8 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
2 Mozilla/5.0 zgrab/0.x
2 XTC

リクエスト内容一覧

件数 Method Request Protocol
14 \x16\x03\x01
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /HNAP1 HTTP/1.1
1 GET /ReportServer HTTP/1.1
8 GET /admin/login.asp HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP HTTP/1.1
1 GET /shell?busybox HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 HEAD / HTTP/1.1
2 POST /api/jsonws/invoke HTTP/1.1
2 POST /cgi-bin/mainfunction.cgi HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 35.222.170.114 United States
1 35.225.205.210 United States
1 42.115.14.135 Cambodia
1 45.184.40.163 Brazil
1 54.223.233.135 China
1 58.210.198.250 China
1 74.208.198.142 United States
1 103.11.117.117 India
1 103.245.116.94 India
1 115.96.109.189 India
1 128.201.66.126 Brazil
1 129.150.69.85 United States
1 129.150.207.75 United States
1 130.162.64.24 United States
1 140.238.144.189 United States
1 141.145.123.175 United States
1 144.22.95.234 Brazil
1 183.131.51.207 China
1 185.202.0.22 Russia
1 192.241.223.178 United States
1 192.241.227.209 United States
1 192.241.227.241 United States
1 193.118.53.202 Germany
2 195.54.160.135 Russia
1 197.232.1.182 Kenya
1 200.148.138.53 Brazil
1 201.170.232.243 Mexico
1 217.19.208.24 Republic of Moldova
1 219.138.55.196 China

UserAgent一覧

件数 UserAgent
22 -
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)
3 Mozilla/5.0 zgrab/0.x
1 XTC

リクエスト内容一覧

件数 Method Request Protocol
1 \x03
16 \x16\x03\x01
1 GET /ReportServer HTTP/1.1
5 GET /admin/login.asp HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /manager/html HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /solr/ HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST /cgi-bin/mainfunction.cgi HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 1.82.198.34 China
1 3.6.107.50 United States
1 13.65.81.19 United States
1 42.115.5.187 Cambodia
1 42.115.125.16 Cambodia
1 45.201.171.130 Cambodia
1 45.201.206.172 Cambodia
1 61.2.178.105 India
1 77.52.207.139 Ukraine
1 81.169.188.247 Germany
1 88.208.217.12 United Kingdom
1 91.234.62.17 Russia
1 92.38.21.34 Czechia
1 103.121.29.239 Pakistan
1 113.125.117.57 China
1 116.72.135.69 India
1 128.14.134.170 United States
1 129.144.27.163 United States
1 130.162.67.221 United States
1 132.145.110.173 United States
1 140.238.42.16 United States
2 150.158.108.170 China
1 162.243.133.29 United States
101 180.126.37.229 China
1 180.167.180.242 China
1 183.90.171.171 Thailand
1 185.143.223.55 Russia
1 187.33.253.18 Brazil
10 192.119.91.48 United States
1 192.241.220.107 United States
1 192.241.226.139 United States
10 195.54.160.135 Russia
1 211.23.46.11 Taiwan
1 218.60.56.122 China
1 221.226.62.146 China
1 222.186.19.210 China

UserAgent一覧

件数 UserAgent
23 -
2 Go-http-client/1.1
2 Hello, World
1 Java/1.8.0_251
101 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
10 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1
11 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
3 Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 \x03
13 \x16\x03\x01
1 CONNECT ip[.]ws[.]126[.]net:443 HTTP/1.1
1 CONNECT www[.]google[.]com/:443 HTTP/1.1
2 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
2 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /HNAP1/ HTTP/1.1
1 GET /ReportServer HTTP/1.1
1 GET /TP/html/public/index.php HTTP/1.1
2 GET /TP/index.php HTTP/1.1
2 GET /TP/public/index.php HTTP/1.1
8 GET /admin/login.asp HTTP/1.1
1 GET /elrekt.php HTTP/1.1
1 GET /html/public/index.php HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /index.php HTTP/1.1
2 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP HTTP/1.1
1 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1 HTTP/1.1
101 GET /phpmyadmin/ HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /public/index.php HTTP/1.1
1 GET /solr/ HTTP/1.1
2 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /thinkphp/html/public/index.php HTTP/1.1
2 POST /GponForm/diag_Form?images/ HTTP/1.1
2 POST /api/jsonws/invoke HTTP/1.1
1 POST /index.php?s=captcha HTTP/1.1