コンニチハレバレトシタアオゾラ

つれづれなるままに、日暮らし、ぶろぐにむかひて、心にうつりゆくよしなしごとを、そこはかとなく書きつくれば、

2024/04/15 ハニーポット(仮) 観測記録

ハニーポット(仮) 観測記録 2024/04/15分です。

特徴
共通

GPONルータの脆弱性を狙うアクセス
Spring Bootの脆弱性を狙うアクセス
zgrabによるスキャン行為
/.envへのスキャン行為

Location:JP

CensysInspectによるスキャン行為
curlによるスキャン行為
wpbotによるスキャン行為
.jsへのスキャン行為
/.gitへのスキャン行為

を確認しました。

Location:US

Spring Cloud Gateway脆弱性(CVE-2022-22947)を狙うアクセス
CensysInspectによるスキャン行為

を確認しました。

Location:UK

Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
Spring Cloud Gateway脆弱性(CVE-2022-22947)を狙うアクセス
curlによるスキャン行為
.jsへのスキャン行為
Laravelへのスキャン行為

を確認しました。

Location:SG

Apache HTTP Serverの脆弱性(CVE-2021-41773)を狙うアクセス
D-link製品の脆弱性を狙うアクセス
Liferay Portal JSON Web Serviceの脆弱性(CVE-2020-7961)を狙うアクセス
Spring Cloud Gateway脆弱性(CVE-2022-22947)を狙うアクセス
CensysInspectによるスキャン行為
curlによるスキャン行為
.jsへのスキャン行為
Laravelへのスキャン行為

を確認しました。

アクセス数推移

JP:総アクセス数:86 (前日比:12)
US:総アクセス数:63 (前日比:-13)
UK:総アクセス数:79 (前日比:4)
SG:総アクセス数:88 (前日比:-185)

都合により GET / HTTP/1.1 POST / HTTP/1.1 は除いています。

Location:JP

送信元IPアドレス一覧

件数 送信元IPアドレス
1 4.242.226.139 United States
1 35.87.230.181 United States
1 45.33.80.243 United States
1 45.79.181.223 United States
1 65.49.20.68 United States
3 65.49.20.69 United States
1 91.92.241.63 Bulgaria
1 94.156.65.122 Bulgaria
8 101.32.192.203 Singapore
2 104.192.0.61 United States
8 135.125.217.54 France
7 135.125.246.189 France
1 143.110.161.46 United States
1 162.142.125.225 United States
1 162.243.129.36 United States
4 164.52.0.94 China
13 167.71.106.70 United States
4 185.254.196.173 Ukraine
5 185.254.196.186 Ukraine
13 188.166.221.6 United States
1 192.241.211.22 United States
1 192.241.221.12 United States
1 192.241.234.47 United States
1 198.98.51.91 United States
1 199.45.154.67 United States
2 205.210.31.3 United States
2 205.210.31.82 United States

UserAgent一覧

件数 UserAgent
17 -
2 Go-http-client/1.1
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Firefox/102.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
8 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36
17 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
27 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
2 Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)
1 Mozilla/5.0 (compatible; wpbot/1.0; +https[:]//forms[.]gle/ajBaxygz9jSR8p8G9)
3 Mozilla/5.0 zgrab/0.x
2 Mozilla/5.0
2 curl/8.1.2

リクエスト内容一覧

件数 Method Request Protocol
1 MGLNDD_18.179.20.5_80\n
1 \x16\x03\x01\x01\xfa\x01
2 \x16\x03\x01\x02
13 \x16\x03\x01
25 GET /.env HTTP/1.1
1 GET /.git/config HTTP/1.1
2 GET /1.php HTTP/1.1
1 GET /actuator/health HTTP/1.1
2 GET /bundle.js HTTP/1.1
1 GET /crm/.env HTTP/1.1
1 GET /druid/index.html HTTP/1.1
7 GET /favicon.ico HTTP/1.1
2 GET /files/ HTTP/1.1
2 GET /form.html HTTP/1.1
2 GET /geoip/ HTTP/1.1
1 GET /geoserver/web/ HTTP/1.1
1 GET /hudson HTTP/1.1
2 GET /info.php HTTP/1.1
2 GET /password.php HTTP/1.1
1 GET /robots.txt HTTP/1.1
2 GET /systembc/password.php HTTP/1.1
2 GET /upl.php HTTP/1.1
2 GET /v3/time HTTP/1.1
1 GET /webui/ HTTP/1.1
8 HEAD /Core/Skin/Login.aspx HTTP/1.1
1 POST /boaform/admin/formLogin HTTP/1.1
Location:US

送信元IPアドレス一覧

件数 送信元IPアドレス
1 8.137.106.178 Singapore
1 45.77.174.123 United States
1 45.79.128.205 United States
1 45.79.181.104 United States
1 45.79.181.179 United States
2 45.125.66.34 Hong Kong
1 54.36.115.221 France
1 54.37.79.75 France
11 57.129.23.166 France
1 66.175.213.4 United States
1 66.240.192.82 United States
2 78.153.140.177 Russia
2 80.75.212.75 Ireland
2 83.97.73.245 Germany
7 103.56.61.144 China
1 106.75.173.108 China
1 107.175.70.169 United States
1 137.184.255.41 United States
1 139.59.101.104 Singapore
1 158.255.82.219 Russia
2 162.215.171.162 United States
1 162.243.136.67 United States
1 167.71.18.121 United States
2 167.94.145.59 United States
1 172.104.11.34 United States
1 172.104.11.51 United States
3 184.105.139.70 United States
4 185.142.236.34 Seychelles
1 192.241.237.44 United States
1 194.165.16.72 Panama
1 198.98.51.91 United States
1 198.199.114.28 United States
2 205.210.31.139 United States
1 206.189.121.127 United States
1 216.218.206.67 United States

UserAgent一覧

件数 UserAgent
26 -
5 Go-http-client/1.1
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/109.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.4 Safari/605.1.15
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0
17 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
2 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1 Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)
4 Mozilla/5.0 zgrab/0.x
1 Mozilla/5.0
1 xxx

リクエスト内容一覧

件数 Method Request Protocol
1 \x03
1 \x16\x03\x01\x01H\x01
1 \x16\x03\x01\x01\xfb\x01
17 \x16\x03\x01
2 CONNECT google[.]com:443 HTTP/1.1
2 CONNECT www[.]google[.]com:443 HTTP/1.1
1 GET /.DS_Store HTTP/1.1
17 GET /.env HTTP/1.1
1 GET /.well-known/security.txt HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
1 GET /actuator/health HTTP/1.1
1 GET /boaform/admin/formLogin?username=adminisp&psd=adminisp HTTP/1.0
2 GET /cdn-cgi/trace HTTP/1.1
1 GET /druid/index.html HTTP/1.1
3 GET /favicon.ico HTTP/1.1
1 GET /geoserver/web/ HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /robots.txt HTTP/1.1
1 GET /sitemap.xml HTTP/1.1
1 GET /webui/ HTTP/1.1
1 POST /api/v0/id HTTP/1.1
2 POST /boaform/admin/formLogin HTTP/1.1
1 PRI * HTTP/2.0
Location:UK

送信元IPアドレス一覧

件数 送信元IPアドレス
7 36.156.22.4 China
1 45.33.80.243 United States
1 45.79.181.179 United States
1 45.79.181.223 United States
2 45.125.66.34 Hong Kong
6 45.128.232.213 Bulgaria
12 54.36.115.221 France
1 61.219.11.155 Taiwan
1 66.240.192.82 United States
2 78.153.140.177 Russia
1 80.75.212.75 Ireland
1 82.165.210.172 Germany
2 83.97.73.245 Germany
1 91.238.181.16 Germany
1 107.170.234.43 United States
1 107.170.244.23 United States
13 139.59.95.76 Singapore
1 139.59.101.104 Singapore
1 144.91.65.135 Germany
1 159.65.81.103 United States
1 162.243.152.6 United States
1 172.104.11.4 United States
1 172.104.11.46 United States
1 172.105.128.11 United States
1 172.105.128.13 United States
1 184.105.139.67 United States
3 184.105.247.194 United States
2 185.216.71.4 Bulgaria
1 192.99.7.195 Canada
1 192.155.90.118 United States
1 192.155.90.220 United States
1 192.241.235.23 United States
1 194.67.70.57 Russia
1 198.98.51.91 United States
1 198.199.109.64 United States
2 198.235.24.154 United States
2 198.235.24.207 United States

UserAgent一覧

件数 UserAgent
33 -
3 Go-http-client/1.1
1 Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11) AppleWebKit/604.2.4 (KHTML, like Gecko) Version/9.1.2 Safari/604.2.4
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_1) AppleWebKit/605.1.33 (KHTML, like Gecko) Version/9.1.2 Safari/605.1.33
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.0.0 maglev/24004.1304.2655.7488/50
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.2 Safari/605.1.15
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.3.1 Safari/605.1.15
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 Edg/108.0.1462.46
8 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.57
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.41
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/111.0
13 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
1 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
4 Mozilla/5.0 zgrab/0.x
3 Mozilla/5.0
1 curl/8.1.2

リクエスト内容一覧

件数 Method Request Protocol
1 MGLNDD_132.145.66.34_80\n
1 \x01\xd2N\xe85\x8c\x11\xb1w\x13\xcd\xb56\x12\x86;/\x805\x86\xb6\x99\x1b\x89\xb7\t\xa7\xaa5w\xfb7]]\xd1Z\x13\x7fSY\xa9P\xed\xf1\xbd\x8a\"\xb7z\x9dq\x12o\xf2\x8d\x8f\xeb\xa4\x01\x93\xdcl5\xa6h\xe2\xe6\x89}\xac\xbf\xa0\x90\x1aM\x7f\x02&\xe5\x03\x1b\x1c\xe9&G\x0eR\xf8\r\x7f'\xc5\xb8,y\x8d\xe6\xd38\x1f\x87\x97v\xb2\x1a\x06\x16\x01\xc8\xe3\xecx\xef~\n
1 \x03
1 \x16\x03\x01\x01)\x01
1 \x16\x03\x01\x01H\x01
1 \x16\x03\x01\x01\xfc\x01
25 \x16\x03\x01
2 CONNECT google[.]com:443 HTTP/1.1
1 CONNECT pro.ip-api[.]com:443 HTTP/1.1
1 CONNECT www[.]google[.]com:443 HTTP/1.1
15 GET /.env HTTP/1.1
1 GET /1.php HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
1 GET /actuator/health HTTP/1.1
1 GET /boaform/admin/formLogin?username=ec8&psd=ec8 HTTP/1.0
1 GET /bundle.js HTTP/1.1
2 GET /cdn-cgi/trace HTTP/1.1
1 GET /druid/index.html HTTP/1.1
2 GET /favicon.ico HTTP/1.1
1 GET /files/ HTTP/1.1
1 GET /form.html HTTP/1.1
1 GET /geoip/ HTTP/1.1
1 GET /geoserver/web/ HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /info.php HTTP/1.1
1 GET /password.php HTTP/1.1
1 GET /portal/redlion HTTP/1.1
1 GET /systembc/password.php HTTP/1.1
1 GET /upl.php HTTP/1.1
1 GET /webui/ HTTP/1.1
6 POST /_ignition/execute-solution HTTP/1.1
1 POST /boaform/admin/formLogin HTTP/1.1
Location:SG

送信元IPアドレス一覧

件数 送信元IPアドレス
1 20.171.44.182 United States
1 27.43.205.229 China
1 27.128.234.189 China
1 45.56.108.128 United States
1 45.77.174.123 United States
1 45.79.181.94 United States
1 45.79.181.251 United States
2 45.125.66.34 Hong Kong
6 45.128.232.213 Bulgaria
1 51.107.16.34 United Kingdom
3 54.36.115.221 France
5 54.37.79.75 France
6 57.129.23.166 France
1 64.62.197.188 United States
1 64.62.197.195 United States
1 64.62.197.196 United States
1 66.240.192.82 United States
1 68.183.237.114 United States
1 80.66.88.211 Russia
1 80.75.212.75 Ireland
2 83.97.73.245 Germany
3 103.56.61.130 China
1 107.170.208.31 United States
1 137.184.255.43 United States
13 139.59.95.76 Singapore
1 162.243.141.21 United States
4 164.52.0.94 China
4 165.154.174.108 Hong Kong
1 169.197.86.76 United States
1 172.104.11.4 United States
2 172.104.11.46 United States
4 185.142.236.43 Seychelles
2 192.155.90.220 United States
1 192.241.203.5 United States
1 192.241.210.81 United States
1 192.241.216.41 United States
1 198.98.51.91 United States
2 198.235.24.111 United States
2 199.45.154.22 United States
2 205.210.31.20 United States
1 206.72.198.135 United States
1 216.218.206.66 United States

UserAgent一覧

件数 UserAgent
29 -
1 Custom-AsyncHttpClient
3 Go-http-client/1.1
1 Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30
1 Mozilla/5.0 (Macintosh; ARM Mac OS X) AppleWebKit/613.3.9.1.16 (KHTML, like Gecko) Version/16.0 Safari/613.3.9.1.16
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10; rv:52.0) Gecko/20100101 Firefox/52.0
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.0 Safari/605.2.21
1 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15 Ddg/17.2
3 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_0) AppleWebKit/535.11 (KHTML, like Gecko) Chrome/17.0.963.56 Safari/535.11
1 Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 OPR/94.0.0.0
8 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
2 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36 Edg/92.0.902.62
1 Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0
14 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
3 Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4 240.111 Safari/537.36
1 Mozilla/5.0 (X11; Linux x86_64; rv:108.0) Gecko/20100101 Firefox/108.0
1 Mozilla/5.0 (X11; Linux x86_64; rv:57.0) Gecko/20100101 Firefox/57.0
2 Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
1 Mozilla/5.0 (compatible; CensysInspect/1.1; +https[:]//about[.]censys[.]io/)
4 Mozilla/5.0 zgrab/0.x
2 Mozilla/5.0
1 curl/8.1.2

リクエスト内容一覧

件数 Method Request Protocol
2 MGLNDD_13.67.44.234_80
1 \x03
1 \x16\x03\x01\x01\x17\x01
2 \x16\x03\x01\x02
17 \x16\x03\x01
2 CONNECT google[.]com:443 HTTP/1.1
1 CONNECT www[.]google[.]com:443 HTTP/1.1
15 GET /.env HTTP/1.1
2 GET /.well-known/security.txt HTTP/1.1
1 GET /1.php HTTP/1.1
1 GET /?XDEBUG_SESSION_START=phpstorm HTTP/1.1
1 GET /actuator/gateway/routes HTTP/1.1
1 GET /actuator/health HTTP/1.1
1 GET /bundle.js HTTP/1.1
1 GET /cdn-cgi/trace HTTP/1.1
1 GET /druid/index.html HTTP/1.1
8 GET /favicon.ico HTTP/1.1
1 GET /files/ HTTP/1.1
1 GET /form.html HTTP/1.1
1 GET /geoip/ HTTP/1.1
1 GET /geoserver/web/ HTTP/1.1
1 GET /hudson HTTP/1.1
1 GET /info.php HTTP/1.1
1 GET /password.php HTTP/1.1
1 GET /portal/redlion HTTP/1.1
3 GET /robots.txt HTTP/1.1
2 GET /sitemap.xml HTTP/1.1
1 GET /systembc/password.php HTTP/1.1
1 GET /systembc/password.php HTTP/1.0
1 GET /upl.php HTTP/1.1
1 GET /webui/ HTTP/1.1
1 HEAD /.env HTTP/1.1
1 HEAD / HTTP/1.0
1 POST /HNAP1/ HTTP/1.0
6 POST /_ignition/execute-solution HTTP/1.1
2 POST /boaform/admin/formLogin HTTP/1.1
1 POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
1 PRI * HTTP/2.0