网站是被攻击了吗？

ibmall

188.131.157.195:20246 - - [02/Jan/2019:09:42:15] "PROPFIND /" 403 1354
188.131.157.195:20315 - - [02/Jan/2019:09:42:17] "GET /webdav/" 404 3292
188.131.157.195:20454 - - [02/Jan/2019:09:42:17] "GET /help.php" 404 3292
188.131.157.195:20589 - - [02/Jan/2019:09:42:18] "GET /java.php" 404 3292
188.131.157.195:20891 - - [02/Jan/2019:09:42:21] "GET /test.php" 404 3292
188.131.157.195:21202 - - [02/Jan/2019:09:42:22] "GET /db_cts.php" 404 3292
188.131.157.195:21582 - - [02/Jan/2019:09:42:25] "GET /db_pma.php" 404 3292
108.162.215.139:58290 - - [02/Jan/2019:09:42:27] "GET /" 200 12325
188.131.157.195:21827 - - [02/Jan/2019:09:42:28] "GET /logon.php" 404 3292
188.131.157.195:22777 - - [02/Jan/2019:09:42:37] "GET /help-e.php" 404 3292
188.131.157.195:23537 - - [02/Jan/2019:09:42:46] "GET /license.php" 404 3292
188.131.157.195:24319 - - [02/Jan/2019:09:42:58] "GET /log.php" 404 3292
188.131.157.195:24592 - - [02/Jan/2019:09:43:01] "GET /hell.php" 404 3292
188.131.157.195:25198 - - [02/Jan/2019:09:43:14] "GET /pmd_online.php" 404 3292
188.131.157.195:25512 - - [02/Jan/2019:09:43:17] "GET /x.php" 404 3292
188.131.157.195:25837 - - [02/Jan/2019:09:43:21] "GET /shell.php" 404 3292
188.131.157.195:26032 - - [02/Jan/2019:09:43:22] "GET /htdocs.php" 404 3292
188.131.157.195:26320 - - [02/Jan/2019:09:43:25] "GET /desktop.ini.php" 404 3292
188.131.157.195:26935 - - [02/Jan/2019:09:43:38] "GET /z.php" 404 3292
188.131.157.195:27369 - - [02/Jan/2019:09:43:45] "GET /lala.php" 404 3292
188.131.157.195:27578 - - [02/Jan/2019:09:43:47] "GET /lala-dpr.php" 404 3292
188.131.157.195:27871 - - [02/Jan/2019:09:43:49] "GET /wpc.php" 404 3292
188.131.157.195:28048 - - [02/Jan/2019:09:43:50] "GET /wpo.php" 404 3292
188.131.157.195:28293 - - [02/Jan/2019:09:43:53] "GET /text.php" 404 3292
188.131.157.195:28551 - - [02/Jan/2019:09:43:54] "GET /wp-config.php" 404 3292
188.131.157.195:28790 - - [02/Jan/2019:09:43:57] "GET /muhstik.php" 404 3292
188.131.157.195:29061 - - [02/Jan/2019:09:43:58] "GET /muhstik2.php" 404 3292
188.131.157.195:29175 - - [02/Jan/2019:09:43:58] "GET /muhstiks.php" 404 3292
188.131.157.195:29315 - - [02/Jan/2019:09:44:01] "GET /muhstik-dpr.php" 404 3292
188.131.157.195:29530 - - [02/Jan/2019:09:44:03] "GET /lol.php" 404 3292
188.131.157.195:29868 - - [02/Jan/2019:09:44:05] "GET /uploader.php" 404 3292
188.131.157.195:30066 - - [02/Jan/2019:09:44:07] "GET /cmd.php" 404 3292
188.131.157.195:30367 - - [02/Jan/2019:09:44:09] "GET /cmx.php" 404 3292
188.131.157.195:30519 - - [02/Jan/2019:09:44:11] "GET /cmv.php" 404 3292
188.131.157.195:30848 - - [02/Jan/2019:09:44:13] "GET /cmdd.php" 404 3292
188.131.157.195:31068 - - [02/Jan/2019:09:44:14] "GET /knal.php" 404 3292
188.131.157.195:31354 - - [02/Jan/2019:09:44:17] "GET /cmd.php" 404 3292
188.131.157.195:31649 - - [02/Jan/2019:09:44:21] "GET /shell.php" 404 3292
188.131.157.195:32079 - - [02/Jan/2019:09:44:25] "GET /scripts/setup.php" 404 3292
188.131.157.195:32248 - - [02/Jan/2019:09:44:27] "GET /phpmyadmin/scripts/setup.php" 404 3292
188.131.157.195:32658 - - [02/Jan/2019:09:44:31] "GET /phpMyAdmin/scripts/setup.php" 404 3292
188.131.157.195:32912 - - [02/Jan/2019:09:44:33] "GET /phpmyadmin/scripts/db___.init.php" 404 3292
188.131.157.195:33135 - - [02/Jan/2019:09:44:35] "GET /phpMyAdmin/scripts/db___.init.php" 404 3292
188.131.157.195:33367 - - [02/Jan/2019:09:44:37] "GET /plugins/weathermap/editor.php" 404 3292
188.131.157.195:33904 - - [02/Jan/2019:09:44:46] "GET /cacti/plugins/weathermap/editor.php" 404 3292

ibmall

fatpig05 发表于 2019-1-2 10:18
感觉扫漏洞比较像一点，哈

还好看了一眼日志，第一次碰到

aRNoLD

这种情况多得很，昨天也遇到过，扫了挺长时间的。

加个ModSecurity到Apache或Nginx里去防一下。

ibmall

aRNoLD 发表于 2019-1-2 10:30
这种情况多得很，昨天也遇到过，扫了挺长时间的。

加个ModSecurity到Apache或Nginx里去防一下。 ...

在论坛一发帖，扫描就消失了，怎么这么巧？

blanco

哈哈，全球扫描喊话论坛

aRNoLD

ibmall 发表于 2019-1-2 10:31
在论坛一发帖，扫描就消失了，怎么这么巧？

这个扫描本来就是随机的，很快。

ibmall

aRNoLD 发表于 2019-1-2 11:13
这个扫描本来就是随机的，很快。

我想知道，网站怎么被纳入扫描范围的？

hyear

ibmall 发表于 2019-1-2 11:19
我想知道，网站怎么被纳入扫描范围的？

要么是缘份 要么是有东西人家感兴趣

ibmall

hyear 发表于 2019-1-2 11:21
要么是缘份 要么是有东西人家感兴趣

看来是缘分了，被扫描的就是我签名的博客，人家应该没啥兴趣

re_move

应该是扫的ip不是域名吧，两条iptables规则可治