求助,服务器遭受攻击

[zh841318441]

怀疑是 nginx 遭受攻击，https 没法访问。 每过一段时间 就有一个陌生 ip 访问

这是 nginx 访问日志，求助这是什么问题

2019/06/13 12:08:11 [notice] 24411#0: signal process started 2019/06/13 13:20:18 [error] 24412#0: *1672 open() "/usr/local/nginx/html/index.php" failed (2: No such file or directory), client: 106.12.138.103, server: zh.8kela.com, request: "GET /index.php HTTP/1.1", host: "212.64.40.177" 2019/06/13 13:20:18 [error] 24412#0: *1672 open() "/usr/local/nginx/html/phpmyadmin/index.php" failed (2: No such file or directory), client: 106.12.138.103, server: zh.8kela.com, request: "GET /phpmyadmin/index.php HTTP/1.1", host: "212.64.40.177" 2019/06/13 14:02:10 [error] 24412#0: *1829 open() "/usr/local/nginx/html/thinkphp/html/public/index.php" failed (2: No such file or directory), client: 58.251.121.185, server: zh.8kela.com, request: "GET /thinkphp/html/public/index.php HTTP/1.1", host: "212.64.40.177"

[Kaiyuan]

@Jirajine #20 我没坑人啊，不一定全部都 301，我自己是把所有敏感访问都 301，反正所有 CC 和暴力破解都让它自爆了。
例如 Wordpress

[shuizhengqi]

再正常不过了，只要你对外提供服务，就有人扫你，还有暴力破解

[lzhnull]

太可怕了，报警没。

[hanguofu]

我觉得 Kaiyuan 的方法挺好，学习了。

[lanceboss]

正常啊。肉鸡在扫描呀。不然你以为市面上这么多肉鸡哪里来的。

HTTPS 访问不了有可能是你配置证书的原因。收费排查哈。

[liukangxu]

还有更腹黑的方法，Zip Bomb 了解一下： https://hackaday.com/2017/07/08/dropping-zip-bombs-on-vulnerability-scanners/