![从随机 IP 地址获取大量流量](https://linux22.com/image/671943/%E4%BB%8E%E9%9A%8F%E6%9C%BA%20IP%20%E5%9C%B0%E5%9D%80%E8%8E%B7%E5%8F%96%E5%A4%A7%E9%87%8F%E6%B5%81%E9%87%8F.png)
Digital ocean 关闭了我的 droplet,以便 droplet 上有流量。我创建了一个新的 droplet(实例),但又遇到了同样的问题。
我的 nginx access.log 中充满了尝试进行 POST 调用的随机 ip 地址。我在最后粘贴了其中的一部分。
为了预防起见,我使用 fail2ban 将这些 IP 地址列入黑名单。但我需要知道问题的根源
发生这种情况是因为我的系统内有恶意软件吗,或者是我无法控制的事情?
如果是由于任何恶意包导致的,那么我该如何找到它?
2.177.28.141 - - [27/Nov/2015:12:50:13 -0500] "POST / HTTP/1.1" 403 1358 "-" "Apache-HttpClient/UNAVAILABLE (java 1.5)"
5.238.77.154 - - [27/Nov/2015:12:50:33 -0500] "POST / HTTP/1.1" 403 1358 "-" "Apache-HttpClient/UNAVAILABLE (java 1.5)"
5.238.77.154 - - [27/Nov/2015:12:50:34 -0500] "POST / HTTP/1.1" 403 1358 "-" "Apache-HttpClient/UNAVAILABLE (java 1.5)"
2.187.214.241 - - [27/Nov/2015:12:51:11 -0500] "POST / HTTP/1.1" 403 1358 "-" "Apache-HttpClient/UNAVAILABLE (java 1.5)"
2.187.214.241 - - [27/Nov/2015:12:51:11 -0500] "POST / HTTP/1.1" 403 1358 "-" "Apache-HttpClient/UNAVAILABLE (java 1.5)"
188.34.65.121 - - [27/Nov/2015:12:51:25 -0500] "POST / HTTP/1.1" 403 1358 "-" "Apache-HttpClient/UNAVAILABLE (java 1.5)"
188.34.65.121 - - [27/Nov/2015:12:51:26 -0500] "POST / HTTP/1.1" 403 1358 "-" "Apache-HttpClient/UNAVAILABLE (java 1.5)"
5.212.127.104 - - [27/Nov/2015:12:51:26 -0500] "POST / HTTP/1.1" 403 1358 "-" "Apache-HttpClient/UNAVAILABLE (java 1.5)"
5.115.89.63 - - [27/Nov/2015:12:51:27 -0500] "POST / HTTP/1.1" 408 0 "-" "-"
5.115.89.63 - - [27/Nov/2015:12:51:37 -0500] "POST / HTTP/1.1" 403 2641 "-" "-"
2.177.28.141 - - [27/Nov/2015:12:51:57 -0500] "POST / HTTP/1.1" 403 1358 "-" "Apache-HttpClient/UNAVAILABLE (java 1.5)"
2.177.28.141 - - [27/Nov/2015:12:52:02 -0500] "POST / HTTP/1.1" 403 1358 "-" "Apache-HttpClient/UNAVAILABLE (java 1.5)"
5.210.116.108 - - [27/Nov/2015:12:52:11 -0500] "POST / HTTP/1.1" 403 1358 "-" "Apache-HttpClient/UNAVAILABLE (java 1.5)"
5.210.116.108 - - [27/Nov/2015:12:52:13 -0500] "POST / HTTP/1.1" 403 1358 "-" "Apache-HttpClient/UNAVAILABLE (java 1.5)"
答案1
你可以使用 iptables 来阻止此类数据包。使用一些 iptables 自动化工具,如 CSF 或 fail2ban。http://configserver.com/cp/csf.html对我来说很好