ITオムライス
  1. ITオムライス
  2. Posts
  3. webサーバのログの分析2026 10月分

webサーバのログの分析2026 10月分

2026-11-02 技術系

目次

公開している web サーバのログから通常のアクセスではない通信について分析しました。

多かったリクエスト

GeoServer における XML 外部エンティティ(XXE)の脆弱性

地理空間データを共有するためのオープンソースサーバー「GeoServer」の脆弱性を狙った通信です。悪用されると、攻撃者によってサーバー内の機密ファイルの読み取りが行われたり、サーバーを踏み台にした内部ネットワークへの不正アクセス（SSRF）を引き起こされる恐れがあります。

/geoserver/web/

環境変数ファイル(.env)の露出スキャン

WebアプリケーションのデータベースのパスワードやAPIキーなど、重大な機密情報が記述されている「.env」ファイルが外部から直接閲覧可能になっていないかを探る、非常に一般的な自動スキャン攻撃です。

/config/.env
/.docker/.env
/deploy/.env
/server/.env
/staging/.env
/media/.env
/back/.env
/docker/.env
/dashboard/.env
/project/.env
/public/.env
/store/.env
/core/.env
/dev/.env
/demo/.env
/apps/.env
/portal/.env
/client/.env
/shop/.env
/crm/.env
/api/.env
/application/.env
/v1/.env
/build/.env
/prod/.env
/src/.env
/laravel/.env
/admin/.env
/frontend/.env
/cms/.env
/test/.env
/.aws/.env
/backend/.env
/app/.env
/v2/.env
/new/.env
/production/.env
/private/.env
/web/.env
/old/.env
/backup/.env
/sendgrid.env
/config.env
/.docker/laravel/app/.env
/.env

WordPressへの不正アクセス・探索行為

WordPressのログイン画面や、外部からの遠隔操作用API（XML-RPC）を狙った通信です。管理者パスワードの総当たり攻撃（ブルートフォース）や、踏み台としての悪用を目的としたスキャンと考えられます。

/wp-content/admin.php
/post/wp-login.php
/wp-content/themes/index.php
/wp-login.php
/wordpress/
/wp-content/plugins/hellopress/wp_filemanager.php
/xmlrpc.php
/wordpress/wp-json/
/blog/wp-login.php
/wp-content/debug.log
/wordpress/?rest_route=/
/wp-content/uploads/
/wp-includes/ID3/about.php

Cisco 製 Cisco IOS XE などのネットワーク機器の Web UI の脆弱性

Cisco製のネットワーク機器のWeb UIの脆弱性を狙った通信です。

/webui/

PHPUnitのevalをリモート実行

PHPのユニットテストツールのPHPUnitの脆弱性を利用してのeval()を実行しようとする通信です。

/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/phpunit/phpunit/Util/PHP/eval-stdin.php
/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/Util/PHP/eval-stdin.php
/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/phpunit/src/Util/PHP/eval-stdin.php
/lib/phpunit/src/Util/PHP/eval-stdin.php
/lib/phpunit/Util/PHP/eval-stdin.php
/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php
/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/phpunit/Util/PHP/eval-stdin.php
/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/lib/phpunit/phpunit/Util/PHP/eval-stdin.php
/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
/vendor/phpunit/src/Util/PHP/eval-stdin.php
/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

AWS CLI における安全でないファイル権限 (CVE-2026-13769)

ファイルのパーミッションが「誰でも読み取り可能」な状態になってしまう問題があったようです。

/.aws/credentials

wp2shell (CVE-2026-63030 / CVE-2026-60137)

認証なしでリモートからコードを実行できる脆弱性

/wp/?rest_route=/

不審な通信の一覧

アクセス数 メソッド リクエスト
2983 GET HTTP/1.1 /robots.txt
575 GET HTTP/1.1 /favicon.ico
469 GET HTTP/1.1 /.env
399 GET HTTP/1.1 /.git/config
241 GET HTTP/1.1 /wp-login.php
237 GET HTTP/1.1 /.env.local
234 GET HTTP/1.1 /.env.production
231 GET HTTP/1.1 /app-ads.txt
216 GET HTTP/1.1 /.env.backup
216 GET HTTP/1.1 /.env.save
202 GET HTTP/1.1 /.env.bak
202 GET HTTP/1.1 /.env.prod
199 GET HTTP/1.1 /api/.env
198 GET HTTP/1.1 /.env.dev
196 GET HTTP/1.1 /phpinfo.php
194 GET HTTP/1.1 /.aws/credentials
185 GET HTTP/1.1 /backend/.env
185 GET HTTP/1.1 /app/.env
182 GET HTTP/1.1 /.env.old
181 GET HTTP/1.1 /config.json
181 GET HTTP/1.1 /config/.env
179 GET HTTP/1.1 /info.php
178 GET HTTP/1.1 /.env.example
163 GET HTTP/1.1 /.env.staging
158 GET HTTP/1.1 /docker-compose.yml
155 GET HTTP/1.1 /src/.env
153 GET HTTP/1.1 /.env.development
153 GET HTTP/1.1 /web/.env
153 GET HTTP/1.1 /laravel/.env
153 GET HTTP/1.1 /public/.env
152 GET HTTP/1.1 /admin/.env
152 GET HTTP/1.1 /core/.env
146 GET HTTP/1.1 /login
144 GET HTTP/1.1 /.env.test
142 GET HTTP/1.1 /server/.env
141 GET HTTP/1.1 /.env.live
141 GET HTTP/1.1 /_profiler/phpinfo
141 GET HTTP/1.1 /frontend/.env
140 GET HTTP/1.1 /credentials.json
140 GET HTTP/1.1 /.aws/config
139 GET HTTP/1.0 /admin/config.php
138 GET HTTP/1.1 /config.php
138 GET HTTP/1.1 /wp-config.php.bak
136 GET HTTP/1.1 /.env.testing
135 GET HTTP/1.1 /.gitlab-ci.yml
133 GET HTTP/1.1 /.env.dist
131 GET HTTP/1.1 /phpinfo
130 GET HTTP/1.1 /.npmrc
130 GET HTTP/1.1 /.git-credentials
129 GET HTTP/1.1 /.git/HEAD
127 POST HTTP/1.1 /
127 GET HTTP/1.1 /secrets.json
126 GET HTTP/1.1 /appsettings.json
125 GET HTTP/1.1 /config.js
121 GET HTTP/1.1 /application/.env
121 GET HTTP/1.1 /.env~
117 GET HTTP/1.1 /wordpress/
117 GET HTTP/1.1 /cms/.env
117 GET HTTP/1.1 /.docker/config.json
115 GET HTTP/1.1 /blog/
115 GET HTTP/1.1 /.env.swp
114 GET HTTP/1.1 /this_is_a_new_hello_world.php
114 GET HTTP/1.1 /wp/
114 GET HTTP/1.1 /database.sql
114 GET HTTP/1.1 /wp-content/plugins/hellopress/wp_filemanager.php
114 GET HTTP/1.1 /dev/.env
114 GET HTTP/1.1 /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
113 GET HTTP/1.1 /staging/.env
112 GET HTTP/1.1 /test/.env
111 GET HTTP/1.1 /v2/.env
110 GET HTTP/1.1 /.env.docker
110 GET HTTP/1.1 /.env.sample
109 GET HTTP/1.1 /.github/workflows/deploy.yml
108 GET HTTP/1.1 /old/.env
108 GET HTTP/1.1 /v1/.env
107 GET HTTP/1.1 /wp-json/
106 GET HTTP/1.1 /env
106 GET HTTP/1.1 /.s3cfg
105 GET HTTP/1.1 /Dockerfile
103 GET HTTP/1.1 /settings.json
103 GET HTTP/1.1 /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php
101 GET HTTP/1.1 /phpunit/phpunit/src/Util/PHP/eval-stdin.php
100 GET HTTP/1.1 /.env.php
100 GET HTTP/1.1 /phpunit/src/Util/PHP/eval-stdin.php
100 GET HTTP/1.1 /config.yaml
100 GET HTTP/1.1 /backup/.env
100 GET HTTP/1.1 /lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php
99 POST HTTP/1.1 /hello.world?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input
98 GET HTTP/1.1 /wp-content/debug.log
97 GET HTTP/1.1 /vendor/phpunit/src/Util/PHP/eval-stdin.php
97 GET HTTP/1.1 /.well-known/security.txt
97 GET HTTP/1.1 /vendor/phpunit/Util/PHP/eval-stdin.php
96 GET HTTP/1.1 /.boto
96 GET HTTP/1.1 /vendor/phpunit/phpunit/LICENSE/eval-stdin.php
96 POST HTTP/1.1 /index.php?-d+allow_url_include%3don+-d+auto_prepend_file%3dphp%3a//input
96 GET HTTP/1.1 /vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
96 POST HTTP/1.1 /test.hello?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input
96 GET HTTP/1.1 /credentials
96 POST HTTP/1.1 /index.php?%25ADd+allow_url_include%3D1+%25ADd+auto_prepend_file%3Dphp://input
96 GET HTTP/1.1 /env.js
95 GET HTTP/1.1 /phpunit/phpunit/Util/PHP/eval-stdin.php
95 GET HTTP/1.1 /post/20200329/site_icons/icon-192x192.png
95 GET HTTP/1.1 /sendgrid.env
94 GET HTTP/1.1 /lib/phpunit/src/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /lib/phpunit/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /phpunit/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
94 GET HTTP/1.1 /lib/phpunit/phpunit/Util/PHP/eval-stdin.php
93 GET HTTP/1.1 /admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
93 GET HTTP/1.1 /crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
93 GET HTTP/1.1 /.amplifyrc
92 GET HTTP/1.1 /workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
92 GET HTTP/1.1 /panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
92 GET HTTP/1.1 /public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
92 GET HTTP/1.1 /blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
92 GET HTTP/1.1 /backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
92 GET HTTP/1.1 /app.js
91 GET HTTP/1.1 /index.php?lang=../../../../../../../../tmp/index1
91 GET HTTP/1.1 /app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
91 GET HTTP/1.1 /apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
91 GET HTTP/1.1 /containers/json
90 GET HTTP/1.1 /new/.env
90 GET HTTP/1.1 /config/aws.yml
90 GET HTTP/1.1 /production/.env
89 GET HTTP/1.1 /.git/index
89 GET HTTP/1.1 /.svn/entries
89 GET HTTP/1.1 /config.env
89 GET HTTP/1.1 /chosen.php
89 GET HTTP/1.1 /news/
88 GET HTTP/1.1 /cms/
88 GET HTTP/1.1 /media/.env
88 GET HTTP/1.1 /press/
88 GET HTTP/1.1 /site/
88 GET HTTP/1.1 /back/.env
87 GET HTTP/1.1 /.docker/.env
86 GET HTTP/1.1 /env-config.js
86 GET HTTP/1.1 /.git/logs/HEAD
85 GET HTTP/1.1 /runtime-config.js
85 GET HTTP/1.1 /composer.json
84 GET HTTP/1.1 /aws-exports.js
84 GET HTTP/1.1 /index.js
83 GET HTTP/1.1 /.env.stage
82 GET HTTP/1.1 /demo/.env
81 GET HTTP/1.1 /env.txt
80 POST HTTP/1.1 /wp-json/batch/v1
80 GET HTTP/1.1 /.env.aws
80 GET HTTP/1.1 /appsettings.Production.json
80 GET HTTP/1.1 /config/config.js
79 GET HTTP/1.1 /credentials.ini
79 GET HTTP/1.1 /api/phpinfo.php
79 GET HTTP/1.1 /.docker/laravel/app/.env
79 GET HTTP/1.1 /.env-example
78 GET HTTP/1.1 /.gitmodules
78 GET HTTP/1.1 /appsettings.Development.json
78 GET HTTP/1.1 /.aws/.env
78 POST HTTP/1.1 /api
77 GET HTTP/1.1 /auth.json
77 POST HTTP/1.1 /xmlrpc.php
76 GET HTTP/1.1 /vendor/composer/installed.json
76 GET HTTP/1.1 /sse
76 GET HTTP/1.1 /.env.openai
76 GET HTTP/1.1 /.env.anthropic
75 GET HTTP/1.1 /.aws/credentials.bak
74 GET HTTP/1.1 /BDKR28WP.php
74 GET HTTP/1.1 /3PJcpMFsD8B.php
74 GET HTTP/1.1 /.env-sample
73 GET HTTP/1.1 /.claude/settings.local.json
72 GET HTTP/1.1 /.claude/settings.json
72 GET HTTP/1.1 /.git/logs/refs/heads/main
68 GET HTTP/1.1 /1.php
66 GET HTTP/1.1 /.env.production.local
66 GET HTTP/1.1 /geoserver/web/
66 GET HTTP/1.1 /app.config.js
65 GET HTTP/1.1 /b8.php
65 GET HTTP/1.1 /wp_blog_footer.php
65 GET HTTP/1.1 /simple.php
65 GET HTTP/1.1 /wp-config.php
65 GET HTTP/1.1 /dex.php
65 GET HTTP/1.1 /test.php
64 GET HTTP/1.1 /wordpress/wp-json/
64 GET HTTP/1.1 /wp/wp-json/
64 GET HTTP/1.1 /blog/wp-json/
63 GET HTTP/1.1 /site/wp-json/
63 GET HTTP/1.1 /site/?rest_route=/
63 GET HTTP/1.1 /blog/?rest_route=/
63 GET HTTP/1.1 /cms/wp-json/
63 GET HTTP/1.1 /docker/.env
63 GET HTTP/1.1 /webui/
63 GET HTTP/1.1 /news/wp-json/
63 GET HTTP/1.1 /wp/?rest_route=/
63 GET HTTP/1.1 /press/wp-json/
62 GET HTTP/1.1 /222.php
62 GET HTTP/1.1 /press/?rest_route=/
62 GET HTTP/1.1 /developmentserver/metadatauploader
62 GET HTTP/1.1 /wordpress/?rest_route=/
62 GET HTTP/1.1 /news/?rest_route=/
62 GET HTTP/1.1 /cms/?rest_route=/
62 GET HTTP/1.1 /.env.preprod
61 GET HTTP/1.1 /radio.php
61 GET HTTP/1.1 /llms.txt
60 GET HTTP/1.1 /adminfuns.php
60 GET HTTP/1.1 /.env.development.local
60 GET HTTP/1.1 /build/.env
60 GET HTTP/1.1 /wp-content/uploads/
58 GET HTTP/1.1 /wp-includes/ID3/about.php
58 GET HTTP/1.1 /a.php
58 GET HTTP/1.1 /0.php
58 GET HTTP/1.1 /media.php
58 GET HTTP/1.1 /wp-content/admin.php
57 GET HTTP/1.1 /register
56 GET HTTP/1.1 /mcp/
56 GET HTTP/1.1 /mcp
56 GET HTTP/1.1 /api/mcp
56 GET HTTP/1.1 /post/wp-login.php
55 GET HTTP/1.1 /cdn-cgi/trace
55 GET HTTP/1.1 /wp-admin/
55 GET HTTP/1.1 /wp-content/themes/index.php
55 GET HTTP/1.1 /alfa.php
55 GET HTTP/1.1 /opsh.php
54 GET HTTP/1.1 /mac.php
53 GET HTTP/1.1 /txets.php
52 GET HTTP/1.1 /docker-compose.yaml
52 GET HTTP/1.1 /apps/.env
52 GET HTTP/1.1 /.well-known/traffic-advice
52 GET HTTP/1.1 /security.txt
51 GET HTTP/1.1 /login.html
51 GET HTTP/1.1 /ai.txt
51 GET HTTP/1.1 /storage/logs/laravel.log
50 POST HTTP/1.1 /admin
50 GET HTTP/1.1 /sw.js.map
50 GET HTTP/1.1 /wp.php
50 GET HTTP/1.1 /portal/.env
50 GET HTTP/1.1 /evox/about
50 GET HTTP/1.1 /sitemap_index.xml
49 GET HTTP/1.1 /service-account.json
49 GET HTTP/1.1 /client/.env
49 POST HTTP/1.1 /sdk
49 GET HTTP/1.1 /w.php
49 GET HTTP/1.1 /.env.staging.local
48 GET HTTP/1.1 /service-worker.js
48 GET HTTP/1.1 /dashboard/.env
48 GET HTTP/1.1 /config.php.bak
48 POST HTTP/1.1 /graphql
48 POST HTTP/1.1 /login
48 GET HTTP/1.1 /go.php
48 GET HTTP/1.1 /.ssh/id_rsa
48 GET HTTP/1.1 /ops.php
47 GET HTTP/1.1 /.netrc
47 GET HTTP/1.1 /.env.dev.local
47 GET HTTP/1.1 /private/.env
47 POST HTTP/1.1 /api/graphql
46 GET HTTP/1.1 /project/.env
46 GET HTTP/1.1 /HNAP1
46 GET HTTP/1.1 /prod/.env
46 POST HTTP/1.1 /dashboard
46 GET HTTP/1.1 /ccc.php
46 GET HTTP/1.1 /i.php
45 GET HTTP/1.1 /backup.sql
45 GET HTTP/1.1 /admin/login
44 GET HTTP/1.1 /images.php
44 GET HTTP/1.1 /k.php
44 GET HTTP/1.1 /shop/.env
43 GET HTTP/1.1 /img.php
43 GET HTTP/1.1 /min.php
43 GET HTTP/1.1 /f35.php
42 GET HTTP/1.1 /blog/wp-login.php
42 GET HTTP/1.1 /.ssh/id_ed25519
42 GET HTTP/1.1 /.env.config
42 POST HTTP/1.1 /v1/graphql
42 GET HTTP/1.1 /db.sql
42 GET HTTP/1.1 /wp-json
42 GET HTTP/1.1 /site.zip
42 GET HTTP/1.1 /wp-config.php.old
42 GET HTTP/1.1 /signin
42 GET HTTP/1.1 /myglu.php
42 GET HTTP/1.1 /.env.ci
42 GET HTTP/1.1 /crm/.env
41 GET HTTP/1.1 /actuator/env
41 GET HTTP/1.1 /user/login
41 GET HTTP/1.1 /bnmtp.php
41 GET HTTP/1.1 /deploy/.env
41 GET HTTP/1.1 /server.key
41 GET HTTP/1.1 /store/.env
40 GET HTTP/1.1 /api-docs





最近読んでる本




関連記事

新着記事