关于新创建的VPS的未知和未识别的职位请求
关于新创建的VPS的未知和未识别的职位请求
提问于 2019-08-05 08:00:38
我为一个个人项目创建了一个VPS。我已经为传入的流量设置了NGINX代理。我打开了用于测试SSL和域名的服务器，并暂时将其放在基本auth之后。
我刚刚注意到很多来自http://117.48.205.227的帖子请求，它试图访问
nginx_1 | 117.48.205.227 - - [05/Aug/2019:07:45:27 +0000] "GET /phpdm.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0"
nginx_1 | 117.48.205.227 - - [05/Aug/2019:07:45:28 +0000] "GET /root.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0"
nginx_1 | 117.48.205.227 - - [05/Aug/2019:07:45:28 +0000] "GET /5678.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0"
nginx_1 | 117.48.205.227 - - [05/Aug/2019:07:45:28 +0000] "GET /root11.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0"
nginx_1 | 117.48.205.227 - - [05/Aug/2019:07:45:28 +0000] "GET /xiu.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 5.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.36 SE 2.X MetaSr 1.0"
nginx_1 | 117.48.205.227 - - [05/Aug/2019:07:45:28 +0000] "POST /wuwu11.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
nginx_1 | 117.48.205.227 - - [05/Aug/2019:07:45:29 +0000] "POST /xw.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
nginx_1 | 117.48.205.227 - - [05/Aug/2019:07:45:29 +0000] "POST /xw1.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
nginx_1 | 117.48.205.227 - - [05/Aug/2019:07:45:29 +0000] "POST /9678.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
nginx_1 | 117.48.205.227 - - [05/Aug/2019:07:45:30 +0000] "POST /wc.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
nginx_1 | 117.48.205.227 - - [05/Aug/2019:07:45:30 +0000] "POST /xx.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
nginx_1 | 117.48.205.227 - - [05/Aug/2019:07:45:30 +0000] "POST /xx.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
nginx_1 | 117.48.205.227 - - [05/Aug/2019:07:45:30 +0000] "POST /s.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
nginx_1 | 117.48.205.227 - - [05/Aug/2019:07:45:31 +0000] "POST /w.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
nginx_1 | 117.48.205.227 - - [05/Aug/2019:07:45:31 +0000] "POST /sheep.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"
nginx_1 | 117.48.205.227 - - [05/Aug/2019:07:45:31 +0000] "POST /qaq.php HTTP/1.1" 301 169 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36"这只是所有请求中的一小部分。是有人试图找到没有保护的路线还是什么的，还是这是奇怪的爬虫什么的？
不管怎样，我该怎么处理呢？我的the服务器目前对Internet关闭。
欢迎光临！
回答 1
Server Fault用户
回答已采纳
发布于 2019-08-05 08:26:51
这些都是来自(很可能)受到损害的VPS农场的标准黑客尝试。您可以忽略这些攻击，前提是您在将web应用程序和web服务器打开到internet之前已经加固了它。SSH服务器、FTP服务器和VPS的每个其他入口点也是如此。如果您转到SSH日志(或任何其他日志，如FTP)，您将看到来自相同类型IP地址的相同类型的黑客尝试。请查找"VPS硬化“并按照说明执行。
页面原文内容由Server Fault提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://serverfault.com/questions/977968
复制相关文章
相似问题
腾讯云开发者
Copyright © 2013 - 2026 Tencent Cloud. All Rights Reserved. 腾讯云 版权所有
深圳市腾讯计算机系统有限公司 ICP备案/许可证号：粤B2-20090059 
粤公网安备44030502008569号
腾讯云计算（北京）有限责任公司 京ICP证150476号 | 京ICP备11018762号