新买的阿里云服务器，开了一个/api 路径指向本地端口 8008 的服务，没给任何人说，结果发现这些乱七八糟的访问日志（只列举了一小部分），这是在找我的服务器后门吗？
[26/Nov/2024 10:56:41] "GET /rt/jobs HTTP/1.0" 404 -
[26/Nov/2024 10:56:44] "GET /sprint/getAllProcess HTTP/1.0" 404 -
[26/Nov/2024 10:56:47] "GET /index.html HTTP/1.0" 404 -
[26/Nov/2024 10:56:47] "GET /overview HTTP/1.0" 404 -
[26/Nov/2024 10:56:49] "GET /console/proxy HTTP/1.0" 404 -
[26/Nov/2024 10:56:54] "GET /hbase/idcs HTTP/1.0" 404 -
[26/Nov/2024 10:56:55] "GET /order/getOrderType HTTP/1.0" 404 -
[26/Nov/2024 10:57:02] "GET /v1/login/status HTTP/1.0" 404 -
[26/Nov/2024 10:57:02] "GET /appConfig.json HTTP/1.0" 404 -
[26/Nov/2024 10:57:03] "GET /dashboards/home HTTP/1.0" 404 -
[26/Nov/2024 10:57:04] "GET /search HTTP/1.0" 404 -
[26/Nov/2024 10:57:34] "GET / HTTP/1.0" 200 -
[26/Nov/2024 10:57:35] "POST / HTTP/1.0" 405 -
[26/Nov/2024 10:58:04] "GET /geojson?url=file:////etc/rpc HTTP/1.0" 404 -
[26/Nov/2024 17:38:46] "GET /settings/public HTTP/1.0" 404 -
[26/Nov/2024 17:38:46] "GET /v1/serve HTTP/1.0" 404 -
[27/Nov/2024 09:51:39] "GET /settings/public HTTP/1.0" 404 -
[27/Nov/2024 09:51:39] "GET /v1beta1/getcluster?api_version=v1beta1&obregion_name= HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /v1/debug/pprof/goroutine?debug=1 HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /v1/debug/pprof/trace HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /manyou/cloud_channel.htm HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /v1/info HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /v1/ HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /vabcd HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /config.json HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /v1/targets HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /v1/serve HTTP/1.0" 404 -
[27/Nov/2024 09:51:41] "GET /systeminfo HTTP/1.0" 404 -
[27/Nov/2024 09:51:42] "GET /docs/ HTTP/1.0" 404 -
[27/Nov/2024 09:51:42] "GET /-docs/ HTTP/1.0" 404 -
[27/Nov/2024 09:51:42] "GET /v1/milvus/connect HTTP/1.0" 404 -
[27/Nov/2024 09:51:42] "GET /agent.html HTTP/1.0" 404 -
[27/Nov/2024 09:51:42] "GET /settings HTTP/1.0" 404 -
[27/Nov/2024 09:51:42] "GET /settings/values HTTP/1.0" 404 -
[27/Nov/2024 09:51:42] "GET /workflows HTTP/1.0" 404 -
6 条回复 • 2024-11-27 19:47:20 +08:00
 |
1
IDAEngine 30 天前
证明以前部署过这些服务
|
 |
2
sunny352787 30 天前
是的，就是在扫，非常烦
|
 |
3
Devifish 30 天前 via iPhone  1
大多数请求看着像业务的， 部分是扫端口漏洞的。 应该是这 ip 上任机主的其他服务没改配置
|
 |
4
yinmin 30 天前 via iPhone 1
如果仅做 api 服务，可以关闭 http ，只开 https ，然后关闭 https 无 sni 访问，然后就消停了
|
 |
5
MrYELiex 30 天前
习惯就好 随便他扫呗 又不会有什么问题 自己代码写健壮就好了 要来扫拦不住的
|
 |
6
Miranquil 29 天前
不一定是在扫，换个端口试试。如果立即没有记录了那可能只是现有服务没更新服务端地址。
|
Select Language