中国からWordPressサーバに悪意のあるリクエストが大量に届くので解析

概要

以前、このブログを運用しているWordPressサーバにフランスから大量のリクエストがありましたが、今度は中国から大量のリクエストが届いていたようなので、Apacheのログを調べてみました。

https://tech-blog.s-yoshiki.com/2018/08/373/

Apacheのログ

bitnami + WordPressの場合、Apacheのログはここにあります。

# logのパス
/opt/bitnami/apache2/logs/access_log

ipが122.152.249.187と出てきました。\n ちょっとググったら「中国」や「スパム」というキーワードが出てきます。\n また、組織名は「Shenzhen Tencent Computer Systems Company Limited」となっていました。

リクエスト内容

気になるリクエスト内容は以下のようになっていました。

長いので、先に結論からいうと、webdavやphpmyadminなど、ありがちな名前のファイル名をたたいていました。

とりあえず気落ち悪いので、アクセス制限を検討しようと思います。

# access_log
122.152.249.187 - - [17/Sep/2018:07:29:35 +0000] "PROPFIND / HTTP/1.1" 302 202
122.152.249.187 - - [17/Sep/2018:07:29:35 +0000] "GET /webdav/ HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:36 +0000] "GET /help.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:36 +0000] "GET /java.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:36 +0000] "GET /_query.php HTTP/1.1" 302 215
122.152.249.187 - - [17/Sep/2018:07:29:36 +0000] "GET /test.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:36 +0000] "GET /db_cts.php HTTP/1.1" 302 215
122.152.249.187 - - [17/Sep/2018:07:29:36 +0000] "GET /db_pma.php HTTP/1.1" 302 215
122.152.249.187 - - [17/Sep/2018:07:29:36 +0000] "GET /logon.php HTTP/1.1" 302 214
122.152.249.187 - - [17/Sep/2018:07:29:36 +0000] "GET /help-e.php HTTP/1.1" 302 215
122.152.249.187 - - [17/Sep/2018:07:29:36 +0000] "GET /license.php HTTP/1.1" 302 216
122.152.249.187 - - [17/Sep/2018:07:29:36 +0000] "GET /log.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:36 +0000] "GET /hell.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:37 +0000] "GET /pmd_online.php HTTP/1.1" 302 219
122.152.249.187 - - [17/Sep/2018:07:29:37 +0000] "GET /x.php HTTP/1.1" 302 210
122.152.249.187 - - [17/Sep/2018:07:29:37 +0000] "GET /shell.php HTTP/1.1" 302 214
122.152.249.187 - - [17/Sep/2018:07:29:37 +0000] "GET /desktop.ini.php HTTP/1.1" 302 220
122.152.249.187 - - [17/Sep/2018:07:29:37 +0000] "GET /z.php HTTP/1.1" 302 210
122.152.249.187 - - [17/Sep/2018:07:29:37 +0000] "GET /lala.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:37 +0000] "GET /lala-dpr.php HTTP/1.1" 302 217
122.152.249.187 - - [17/Sep/2018:07:29:37 +0000] "GET /wpo.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:37 +0000] "GET /text.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:37 +0000] "GET /wp-config.php HTTP/1.1" 302 218
122.152.249.187 - - [17/Sep/2018:07:29:37 +0000] "GET /muhstik.php HTTP/1.1" 302 216
122.152.249.187 - - [17/Sep/2018:07:29:37 +0000] "GET /muhstik2.php HTTP/1.1" 302 217
122.152.249.187 - - [17/Sep/2018:07:29:37 +0000] "GET /muhstiks.php HTTP/1.1" 302 217
122.152.249.187 - - [17/Sep/2018:07:29:37 +0000] "GET /muhstik-dpr.php HTTP/1.1" 302 220
122.152.249.187 - - [17/Sep/2018:07:29:37 +0000] "GET /lol.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:38 +0000] "GET /uploader.php HTTP/1.1" 302 217
122.152.249.187 - - [17/Sep/2018:07:29:38 +0000] "GET /cmd.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:38 +0000] "GET /cmx.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:38 +0000] "GET /cmv.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:38 +0000] "GET /cmdd.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:38 +0000] "GET /knal.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:38 +0000] "GET /cmd.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:39 +0000] "GET /shell.php HTTP/1.1" 302 214
122.152.249.187 - - [17/Sep/2018:07:29:39 +0000] "GET /appserv.php HTTP/1.1" 302 216
122.152.249.187 - - [17/Sep/2018:07:29:39 +0000] "POST /wuwu11.php HTTP/1.1" 302 215
122.152.249.187 - - [17/Sep/2018:07:29:39 +0000] "POST /xw.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:39 +0000] "POST /xw1.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:39 +0000] "POST /9678.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:39 +0000] "POST /wc.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:39 +0000] "POST /xx.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:39 +0000] "POST /s.php HTTP/1.1" 302 210
122.152.249.187 - - [17/Sep/2018:07:29:39 +0000] "POST /w.php HTTP/1.1" 302 210
122.152.249.187 - - [17/Sep/2018:07:29:39 +0000] "POST /sheep.php HTTP/1.1" 302 214
122.152.249.187 - - [17/Sep/2018:07:29:39 +0000] "POST /qaq.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:40 +0000] "POST /db.init.php HTTP/1.1" 302 216
122.152.249.187 - - [17/Sep/2018:07:29:40 +0000] "POST /db_session.init.php HTTP/1.1" 302 224
122.152.249.187 - - [17/Sep/2018:07:29:40 +0000] "POST /db__.init.php HTTP/1.1" 302 218
122.152.249.187 - - [17/Sep/2018:07:29:40 +0000] "POST /wp-admins.php HTTP/1.1" 302 218
122.152.249.187 - - [17/Sep/2018:07:29:41 +0000] "POST /m.php?pbid=open HTTP/1.1" 302 220
122.152.249.187 - - [17/Sep/2018:07:29:41 +0000] "POST /m.php?pbid=open HTTP/1.1" 302 220
122.152.249.187 - - [17/Sep/2018:07:29:41 +0000] "POST /db_dataml.php HTTP/1.1" 302 218
122.152.249.187 - - [17/Sep/2018:07:29:41 +0000] "POST /db_desql.php HTTP/1.1" 302 217
122.152.249.187 - - [17/Sep/2018:07:29:41 +0000] "POST /mx.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:41 +0000] "POST /wshell.php HTTP/1.1" 302 215
122.152.249.187 - - [17/Sep/2018:07:29:41 +0000] "POST /xshell.php HTTP/1.1" 302 215
122.152.249.187 - - [17/Sep/2018:07:29:41 +0000] "POST /qq.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:41 +0000] "POST /conflg.php HTTP/1.1" 302 215
122.152.249.187 - - [17/Sep/2018:07:29:41 +0000] "POST /lindex.php HTTP/1.1" 302 215
122.152.249.187 - - [17/Sep/2018:07:29:41 +0000] "POST /phpstudy.php HTTP/1.1" 302 217
122.152.249.187 - - [17/Sep/2018:07:29:41 +0000] "POST /phpStudy.php HTTP/1.1" 302 217
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /weixiao.php HTTP/1.1" 302 216
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /feixiang.php HTTP/1.1" 302 217
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /ak47.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /ak48.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /xiao.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /yao.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /defect.php HTTP/1.1" 302 215
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /webslee.php HTTP/1.1" 302 216
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /q.php HTTP/1.1" 302 210
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /pe.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /hm.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /cainiao.php HTTP/1.1" 302 216
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /zuoshou.php HTTP/1.1" 302 216
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /zuo.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /aotu.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /cmd.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:42 +0000] "POST /bak.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:43 +0000] "POST /system.php HTTP/1.1" 302 215
122.152.249.187 - - [17/Sep/2018:07:29:43 +0000] "POST /l6.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:43 +0000] "POST /l7.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:43 +0000] "POST /l8.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:43 +0000] "POST /q.php HTTP/1.1" 302 210
122.152.249.187 - - [17/Sep/2018:07:29:43 +0000] "POST /56.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:43 +0000] "POST /mz.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:43 +0000] "POST /xx.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:43 +0000] "POST /yumo.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:43 +0000] "POST /min.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:43 +0000] "POST /wan.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:43 +0000] "POST /wanan.php HTTP/1.1" 302 214
122.152.249.187 - - [17/Sep/2018:07:29:43 +0000] "POST /ssaa.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:43 +0000] "POST /qq.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:43 +0000] "POST /aw.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:43 +0000] "POST /12.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:44 +0000] "POST /hh.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:44 +0000] "POST /ak.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:44 +0000] "POST /ip.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:44 +0000] "POST /infoo.php HTTP/1.1" 302 214
122.152.249.187 - - [17/Sep/2018:07:29:44 +0000] "POST /qq.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:44 +0000] "POST /qwe.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:44 +0000] "POST /1213.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:45 +0000] "POST /post.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:45 +0000] "POST /h1.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:45 +0000] "POST /test.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:45 +0000] "POST /3.php HTTP/1.1" 302 210
122.152.249.187 - - [17/Sep/2018:07:29:45 +0000] "POST /phpinfi.php HTTP/1.1" 302 216
122.152.249.187 - - [17/Sep/2018:07:29:45 +0000] "POST /aaaa.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:45 +0000] "POST /9510.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:45 +0000] "POST /python.php HTTP/1.1" 302 215
122.152.249.187 - - [17/Sep/2018:07:29:45 +0000] "POST /default.php HTTP/1.1" 302 216
122.152.249.187 - - [17/Sep/2018:07:29:45 +0000] "POST /sean.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:45 +0000] "POST /app.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:46 +0000] "POST /help.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:46 +0000] "POST /tiandi.php HTTP/1.1" 302 215
122.152.249.187 - - [17/Sep/2018:07:29:46 +0000] "POST /miao.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:46 +0000] "POST /xz.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:46 +0000] "POST /linuxse.php HTTP/1.1" 302 216
122.152.249.187 - - [17/Sep/2018:07:29:46 +0000] "POST /zuoindex.php HTTP/1.1" 302 217
122.152.249.187 - - [17/Sep/2018:07:29:46 +0000] "POST /zshmindex.php HTTP/1.1" 302 218
122.152.249.187 - - [17/Sep/2018:07:29:46 +0000] "POST /ceshi.php HTTP/1.1" 302 214
122.152.249.187 - - [17/Sep/2018:07:29:46 +0000] "POST /boots.php HTTP/1.1" 302 214
122.152.249.187 - - [17/Sep/2018:07:29:46 +0000] "POST /she.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:46 +0000] "POST /s.php HTTP/1.1" 302 210
122.152.249.187 - - [17/Sep/2018:07:29:47 +0000] "POST /qw.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:47 +0000] "POST /test.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:47 +0000] "POST /caonma.php HTTP/1.1" 302 215
122.152.249.187 - - [17/Sep/2018:07:29:47 +0000] "POST /ss.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:47 +0000] "POST /wcp.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:47 +0000] "POST /xiaoma.php HTTP/1.1" 302 215
122.152.249.187 - - [17/Sep/2018:07:29:47 +0000] "POST /xiaomae.php HTTP/1.1" 302 216
122.152.249.187 - - [17/Sep/2018:07:29:47 +0000] "POST /xiaomar.php HTTP/1.1" 302 216
122.152.249.187 - - [17/Sep/2018:07:29:47 +0000] "POST /qq.php HTTP/1.1" 302 211
122.152.249.187 - - [17/Sep/2018:07:29:48 +0000] "POST /data.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:48 +0000] "POST /log.php HTTP/1.1" 302 212
122.152.249.187 - - [17/Sep/2018:07:29:48 +0000] "POST /fack.php HTTP/1.1" 302 213
122.152.249.187 - - [17/Sep/2018:07:29:48 +0000] "POST /angge.php HTTP/1.1" 302 214
122.152.249.187 - - [17/Sep/2018:07:29:48 +0000] "GET /index.php HTTP/1.1" 302 214
122.152.249.187 - - [17/Sep/2018:07:29:48 +0000] "GET /phpmyadmin/index.php HTTP/1.1" 302 225
122.152.249.187 - - [17/Sep/2018:07:29:48 +0000] "GET /phpMyAdmin/index.php HTTP/1.1" 302 225
122.152.249.187 - - [17/Sep/2018:07:29:48 +0000] "GET /pmd/index.php HTTP/1.1" 302 218
122.152.249.187 - - [17/Sep/2018:07:29:48 +0000] "GET /pma/index.php HTTP/1.1" 302 218
122.152.249.187 - - [17/Sep/2018:07:29:48 +0000] "GET /PMA/index.php HTTP/1.1" 302 218
122.152.249.187 - - [17/Sep/2018:07:29:48 +0000] "GET /PMA2/index.php HTTP/1.1" 302 219
122.152.249.187 - - [17/Sep/2018:07:29:48 +0000] "GET /pmamy/index.php HTTP/1.1" 302 220
122.152.249.187 - - [17/Sep/2018:07:29:48 +0000] "GET /pmamy2/index.php HTTP/1.1" 302 221
122.152.249.187 - - [17/Sep/2018:07:29:48 +0000] "GET /mysql/index.php HTTP/1.1" 302 220
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /admin/index.php HTTP/1.1" 302 220
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /db/index.php HTTP/1.1" 302 217
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /dbadmin/index.php HTTP/1.1" 302 222
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /web/phpMyAdmin/index.php HTTP/1.1" 302 229
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /admin/pma/index.php HTTP/1.1" 302 224
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /admin/PMA/index.php HTTP/1.1" 302 224
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /admin/mysql/index.php HTTP/1.1" 302 226
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /admin/mysql2/index.php HTTP/1.1" 302 227
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /admin/phpmyadmin/index.php HTTP/1.1" 302 231
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /admin/phpMyAdmin/index.php HTTP/1.1" 302 231
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /admin/phpmyadmin2/index.php HTTP/1.1" 302 232
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /mysqladmin/index.php HTTP/1.1" 302 225
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /mysql-admin/index.php HTTP/1.1" 302 226
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /phpadmin/index.php HTTP/1.1" 302 223
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /phpmyadmin0/index.php HTTP/1.1" 302 226
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /phpmyadmin1/index.php HTTP/1.1" 302 226
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /phpmyadmin2/index.php HTTP/1.1" 302 226
122.152.249.187 - - [17/Sep/2018:07:29:49 +0000] "GET /myadmin/index.php HTTP/1.1" 302 222
122.152.249.187 - - [17/Sep/2018:07:29:50 +0000] "GET /myadmin2/index.php HTTP/1.1" 302 223
122.152.249.187 - - [17/Sep/2018:07:29:50 +0000] "GET /xampp/phpmyadmin/index.php HTTP/1.1" 302 231
122.152.249.187 - - [17/Sep/2018:07:29:50 +0000] "GET /phpMyadmin_bak/index.php HTTP/1.1" 302 229
122.152.249.187 - - [17/Sep/2018:07:29:50 +0000] "GET /www/phpMyAdmin/index.php HTTP/1.1" 302 229
122.152.249.187 - - [17/Sep/2018:07:29:50 +0000] "GET /tools/phpMyAdmin/index.php HTTP/1.1" 302 231
122.152.249.187 - - [17/Sep/2018:07:29:50 +0000] "GET /phpmyadmin-old/index.php HTTP/1.1" 302 229
122.152.249.187 - - [17/Sep/2018:07:29:50 +0000] "GET /phpMyAdminold/index.php HTTP/1.1" 302 228
122.152.249.187 - - [17/Sep/2018:07:29:50 +0000] "GET /phpMyAdmin.old/index.php HTTP/1.1" 302 229
122.152.249.187 - - [17/Sep/2018:07:29:50 +0000] "GET /pma-old/index.php HTTP/1.1" 302 222
122.152.249.187 - - [17/Sep/2018:07:29:50 +0000] "GET /claroline/phpMyAdmin/index.php HTTP/1.1" 302     235
122.152.249.187 - - [17/Sep/2018:07:29:51 +0000] "GET /typo3/phpmyadmin/index.php HTTP/1.1" 302 231
122.152.249.187 - - [17/Sep/2018:07:29:51 +0000] "GET /phpma/index.php HTTP/1.1" 302 220
122.152.249.187 - - [17/Sep/2018:07:29:51 +0000] "GET /phpmyadmin/phpmyadmin/index.php HTTP/1.1" 302     236
122.152.249.187 - - [17/Sep/2018:07:29:51 +0000] "GET /phpMyAdmin/phpMyAdmin/index.php HTTP/1.1" 302     236

中国からWordPressサーバに悪意のあるリクエストが大量に届くので解析

目次

概要

Apacheのログ

リクエスト内容