nginx 的 log 里有几十行 404 是自己的 ip 发起的 request - V2EX
首页 注册 登录
V2EX = way to explore
V2EX 是一个关于分享和探索的地方
现在注册
已注册用户请  登录
请不要在回答技术问题时复制粘贴 AI 生成的内容
geeti
V2EX    程序员

nginx 的 log 里有几十行 404 是自己的 ip 发起的 request

  •   
  •   geeti 2016-08-02 04:27:27 +08:00 4328 次点击
    这是一个创建于 3360 天前的主题，其中的信息可能已经有所发展或是发生改变。
    比如这些 404 ，是被人黑了还是怎么？ 多谢

    access.log:104.236.202.168 - - [01/Aug/2016:02:45:10 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log:104.236.202.168 - - [01/Aug/2016:02:45:10 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log:104.236.202.168 - - [01/Aug/2016:02:45:10 -0400] "GET /CHANGELOG.txt HTTP/1.0" 404 177 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log:104.236.202.168 - - [01/Aug/2016:02:45:10 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log:104.236.202.168 - - [01/Aug/2016:02:45:11 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log:104.236.202.168 - - [01/Aug/2016:02:45:11 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log:104.236.202.168 - - [01/Aug/2016:02:45:11 -0400] "GET /readme.html HTTP/1.0" 404 177 "-" "Mozilla/5.0 (Windows NT 6.3; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log:104.236.202.168 - - [01/Aug/2016:04:31:16 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.1:104.236.202.168 - - [25/Jul/2016:06:47:11 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
    access.log.1:104.236.202.168 - - [25/Jul/2016:06:47:11 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
    access.log.1:104.236.202.168 - - [25/Jul/2016:09:49:48 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.1:104.236.202.168 - - [25/Jul/2016:19:46:03 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
    access.log.1:104.236.202.168 - - [25/Jul/2016:19:46:03 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
    access.log.1:104.236.202.168 - - [26/Jul/2016:00:19:54 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.1:104.236.202.168 - - [26/Jul/2016:12:21:35 -0400] "GET /robots.txt HTTP/1.0" 404 177 "-" "Mozilla/5.0 (Windows NT 6.1) (compatible; SMTBot/1.0; +http://www.similartech.com/smtbot)"
    access.log.1:104.236.202.168 - - [26/Jul/2016:12:21:43 -0400] "GET /robots.txt HTTP/1.0" 404 177 "-" "Mozilla/5.0 (Windows NT 6.1) (compatible; SMTBot/1.0; +http://www.similartech.com/smtbot)"
    access.log.1:104.236.202.168 - - [26/Jul/2016:13:04:25 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
    access.log.1:104.236.202.168 - - [26/Jul/2016:13:04:25 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
    access.log.1:104.236.202.168 - - [27/Jul/2016:04:38:51 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.1:104.236.202.168 - - [27/Jul/2016:11:39:50 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
    access.log.1:104.236.202.168 - - [27/Jul/2016:11:39:50 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
    access.log.1:104.236.202.168 - - [27/Jul/2016:14:57:53 -0400] "GET /robots.txt HTTP/1.0" 404 177 "-" "CSS Certificate Spider ( http://www.css-security.com/certificatespider/)";
    access.log.1:104.236.202.168 - - [28/Jul/2016:07:03:25 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.1:104.236.202.168 - - [29/Jul/2016:05:38:13 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.1:104.236.202.168 - - [29/Jul/2016:22:53:11 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.1:104.236.202.168 - - [31/Jul/2016:00:22:54 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.2:104.236.202.168 - - [18/Jul/2016:04:51:22 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.2:104.236.202.168 - - [19/Jul/2016:08:36:49 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.2:104.236.202.168 - - [19/Jul/2016:21:20:27 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.2:104.236.202.168 - - [20/Jul/2016:14:29:00 -0400] "GET /robots.txt HTTP/1.0" 404 177 "-" "CSS Certificate Spider ( http://www.css-security.com/certificatespider/)";
    access.log.2:104.236.202.168 - - [21/Jul/2016:03:21:34 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.2:104.236.202.168 - - [21/Jul/2016:04:24:28 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.2:104.236.202.168 - - [21/Jul/2016:04:24:29 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log.2:104.236.202.168 - - [21/Jul/2016:04:24:29 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log.2:104.236.202.168 - - [21/Jul/2016:04:24:29 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log.2:104.236.202.168 - - [21/Jul/2016:04:24:30 -0400] "GET / HTTP/1.0" 200 151 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log.2:104.236.202.168 - - [21/Jul/2016:04:24:31 -0400] "GET /readme.html HTTP/1.0" 404 177 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log.2:104.236.202.168 - - [21/Jul/2016:04:24:31 -0400] "GET /CHANGELOG.txt HTTP/1.0" 404 177 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:43.0) Gecko/20100101 Firefox/43.0"
    access.log.2:104.236.202.168 - - [21/Jul/2016:22:57:29 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.2:104.236.202.168 - - [22/Jul/2016:20:53:07 -0400] "GET / HTTP/1.0" 200 151 "-" "-"
    access.log.2:104.236.202.168 - - [24/Jul/2016:01:53:33 -0400] "GET /admin/i18n/readme.txt HTTP/1.0" 404 177 "-" "python-requests/2.8.0"
  • 104.236.202.168
  • log
  • Access
  • Jul
    20 条回复    2016-08-03 17:14:40 +08:00
    eastpiger
        1
    eastpiger  
       2016-08-02 05:59:43 +08:00
    你是不是用了反代？
    geeti
        2
    geeti  
    OP
       2016-08-02 09:19:10 +08:00
    @eastpiger 都不知道是什么。
    nodejs 的监听端口是 3000 ，用 iptables 把 80 重定向到 3000.这算反向代理不？

    即使是这样，那些奇怪的请求是怎么回事？
    谢谢
    yuankui
        3
    yuankui  
       2016-08-02 09:28:23 +08:00   1
    这些问题建议楼主多学点 http ， web 的知识之后再来问~
    jimzhong
        4
    jimzhong  
       2016-08-02 09:36:04 +08:00
    @geeti iptables 重定向不算反代
    geeti
        5
    geeti  
    OP
       2016-08-02 09:42:21 +08:00   3
    @yuankui 我就是问问，您要是愿意指点自然感谢，不愿意也不需要高屋建瓴的给我指导人生方向。乌烟瘴气的环境就是你这种人太多
    serial
        6
    serial  
       2016-08-02 10:31:43 +08:00
    你的静态文件都没有加相对主目录。

    location ~ \.(html|txt)$ 中放上 root
    ayaseangle
        7
    ayaseangle  
       2016-08-02 10:33:41 +08:00
    暴露给外网了吗？估计被扫描了。。
    geeti
        8
    geeti  
    OP
       2016-08-02 10:59:33 +08:00
    @ayaseangle 一个 vps 而已，前一阵子被一些地方推荐，导致每天几千流量。 DDOS 少不了，但是不懂的是为啥会有自己的 public ip 来进行 http request
    lhbc
        9
    lhbc  
       2016-08-02 11:38:13 +08:00
    你没留意到所有的 client ip 都是你自己的服务器 IP 吗？
    run2
        10
    run2  
       2016-08-02 12:03:02 +08:00
    @geeti 他给你指了学习的方向，而不是回答问题 也没什么错吧。。。
    geeti
        11
    geeti  
    OP
       2016-08-02 12:55:38 +08:00 via iPad
    @lhbc 所以我才发这个贴问原因啊。。。为啥？虚心请教
    lhbc
        12
    lhbc  
       2016-08-02 13:04:50 +08:00 via Android
    @geeti 所以，根本不是 404 或者被黑的问题，你的问题应该是“为什么日志里所有的访问者 IP 都是服务器 IP ”
    完全 get 不到你提问的点……

    80 端口用 nginx 做反向代理，用 nginx 记录日志
    iptables 不是干这个用的
    yuankui
        13
    yuankui  
       2016-08-02 13:46:33 +08:00
    我如果直接告诉你 [不是] 结果又能怎样？你是什么水平还是什么水平，你的脑袋一样会很多很多问题，而这些问题你极有可能再开一贴，让大家给你答案。
    与其这样，还是建议你自己多学点，这些基础问题小白问题，就不攻自破了。
    geeti
        14
    geeti  
    OP
       2016-08-02 22:43:21 +08:00
    @lhbc 谢谢。没说清楚。
    为啥 ip 会显示 server 的 ip 呢？
    我没做也没打算做反向代理，用 iptables 转到 3000 只是为了方便， nodejs 调试用的 3000 ，当时没改。但我觉得不应该是因为这个导致的。
    lhbc
        15
    lhbc  
       2016-08-02 22:59:43 +08:00
    @geeti NAT 之后 IP 会改变
    nginx 做反向代理不就是 10 行配置的事情吗
    geeti
        16
    geeti  
    OP
       2016-08-03 02:43:18 +08:00
    @lhbc 为什么这里会涉及到 NAT ？这里没有 NAT 啊， server 是 public vps
    billwsy
        17
    billwsy  
       2016-08-03 05:55:11 +08:00 via iPhone
    @geeti 80 转 3000 是个 NAT
    rogerchen
        18
    rogerchen  
       2016-08-03 09:46:51 +08:00
    @billwsy +1 正解
    libotony
        19
    libotony  
       2016-08-03 10:00:15 +08:00
    好奇怪的实现方式，建议老老实实用 nginx 做反代
    bigpigeon
        20
    bigpigeon  
       2016-08-03 17:14:40 +08:00
    我觉得应该把你的 nginx 配置也贴出来好些，只看日志很难排查
    关于     帮助文档     自助推广系统     博客     API     FAQ     Solana     1065 人在线   最高记录 6679       Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 39ms UTC 23:03 PVG 07:03 LAX 16:03 JFK 19:03
    Do have faith in what you're doing.
    ubao snddm index pchome yahoo rakuten mypaper meadowduck bidyahoo youbao zxmzxm asda bnvcg cvbfg dfscv mmhjk xxddc yybgb zznbn ccubao uaitu acv GXCV ET GDG YH FG BCVB FJFH CBRE CBC GDG ET54 WRWR RWER WREW WRWER RWER SDG EW SF DSFSF fbbs ubao fhd dfg ewr dg df ewwr ewwr et ruyut utut dfg fgd gdfgt etg dfgt dfgd ert4 gd fgg wr 235 wer3 we vsdf sdf gdf ert xcv sdf rwer hfd dfg cvb rwf afb dfh jgh bmn lgh rty gfds cxv xcv xcs vdas fdf fgd cv sdf tert sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf shasha9178 shasha9178 shasha9178 shasha9178 shasha9178 liflif2 liflif2 liflif2 liflif2 liflif2 liblib3 liblib3 liblib3 liblib3 liblib3 zhazha444 zhazha444 zhazha444 zhazha444 zhazha444 dende5 dende denden denden2 denden21 fenfen9 fenf619 fen619 fenfe9 fe619 sdf sdf sdf sdf sdf zhazh90 zhazh0 zhaa50 zha90 zh590 zho zhoz zhozh zhozho zhozho2 lislis lls95 lili95 lils5 liss9 sdf0ty987 sdft876 sdft9876 sdf09876 sd0t9876 sdf0ty98 sdf0976 sdf0ty986 sdf0ty96 sdf0t76 sdf0876 df0ty98 sf0t876 sd0ty76 sdy76 sdf76 sdf0t76 sdf0ty9 sdf0ty98 sdf0ty987 sdf0ty98 sdf6676 sdf876 sd876 sd876 sdf6 sdf6 sdf9876 sdf0t sdf06 sdf0ty9776 sdf0ty9776 sdf0ty76 sdf8876 sdf0t sd6 sdf06 s688876 sd688 sdf86