pureGirl

部署在云上内部使用的服务一直有 ip 恶意请求

  •  
  •   pureGirl · Feb 24, 2025 · 4817 views
    This topic created in 621 days ago, the information mentioned may be changed or developed.
    跟丧尸围城一样
    django.core.exceptions.DisallowedHost: Invalid HTTP_HOST header: '123456.czxcz.cn:8000'. You may need to add '123456.czxcz.cn' to ALLOWED_HOSTS.
    Invalid HTTP_HOST header: '123456.czxcz.cn:8000'. You may need to add '123456.czxcz.cn' to ALLOWED_HOSTS.
    Traceback (most recent call last):
    File "/usr/local/lib/python3.13/site-packages/django/core/handlers/exception.py", line 55, in inner
    response = get_response(request)
    File "/usr/local/lib/python3.13/site-packages/django/utils/deprecation.py", line 128, in __call__
    response = self.process_request(request)
    File "/usr/local/lib/python3.13/site-packages/django/middleware/common.py", line 48, in process_request
    host = request.get_host()
    File "/usr/local/lib/python3.13/site-packages/django/http/request.py", line 151, in get_host
    raise DisallowedHost(msg)
    django.core.exceptions.DisallowedHost: Invalid HTTP_HOST header: '123456.czxcz.cn:8000'. You may need to add '123456.czxcz.cn' to ALLOWED_HOSTS.
    Bad Request: /robots.txt
    Bad Request: /robots.txt
    Invalid HTTP_HOST header: '123456.czxcz.cn:8000'. You may need to add '123456.czxcz.cn' to ALLOWED_HOSTS.
    Traceback (most recent call last):
    File "/usr/local/lib/python3.13/site-packages/django/core/handlers/exception.py", line 55, in inner
    response = get_response(request)
    File "/usr/local/lib/python3.13/site-packages/django/utils/deprecation.py", line 128, in __call__
    response = self.process_request(request)
    File "/usr/local/lib/python3.13/site-packages/django/middleware/common.py", line 48, in process_request
    host = request.get_host()
    File "/usr/local/lib/python3.13/site-packages/django/http/request.py", line 151, in get_host
    raise DisallowedHost(msg)
    django.core.exceptions.DisallowedHost: Invalid HTTP_HOST header: '123456.czxcz.cn:8000'. You may need to add '123456.czxcz.cn' to ALLOWED_HOSTS.
    Invalid HTTP_HOST header: '123456.czxcz.cn:8000'. You may need to add '123456.czxcz.cn' to ALLOWED_HOSTS.
    Traceback (most recent call last):
    File "/usr/local/lib/python3.13/site-packages/django/core/handlers/exception.py", line 55, in inner
    response = get_response(request)
    File "/usr/local/lib/python3.13/site-packages/django/utils/deprecation.py", line 128, in __call__
    response = self.process_request(request)
    File "/usr/local/lib/python3.13/site-packages/django/middleware/common.py", line 48, in process_request
    host = request.get_host()
    File "/usr/local/lib/python3.13/site-packages/django/http/request.py", line 151, in get_host
    raise DisallowedHost(msg)
    django.core.exceptions.DisallowedHost: Invalid HTTP_HOST header: '123456.czxcz.cn:8000'. You may need to add '123456.czxcz.cn' to ALLOWED_HOSTS.
    Bad Request: /sitemap.xml
    Bad Request: /sitemap.xml
    [2025-02-24 04:01:19 +0800] [17] [WARNING] Invalid request from ip=43.158.213.246: Invalid HTTP request line: '\x16\x03\x01\x00Ã\x01\x00\x00¿\x03\x03~Å]Æø¡ô\x88©}à\x91\x7f¶3p\x11¹öôæË2¡±_¨;@Ë0£\x00\x00\x1aÀ/À+À\x11À\x07À\x13À\tÀ\x14À\n\x00\x05\x00/\x005À\x12\x00\n\x01\x00\x00|\x00\x05\x00\x05\x01\x00\x00\x00\x00\x00\n\x00\x08\x00\x06\x00\x17\x00\x18\x00\x19\x00\x0b\x00\x02\x01\x00\x00#\x00\x00\x00\r\x00&\x00$\x06\x01\x06\x03\x06\x02\x05\x01\x05\x03\x05\x02\x04\x01\x04\x03\x04\x02\x03\x01\x03\x03\x03\x02\x02\x01\x02\x03\x02\x02\x01\x01\x01\x03\x01\x02ÿ\x01\x00\x01\x00\x00(\x00"\x00 a%/k\x00T$\x83\x0eç½6¡©À\x97\x8fEÐ'
    [2025-02-24 04:02:26 +0800] [18] [WARNING] Invalid request from ip=43.158.213.246: Invalid HTTP request line: '\x16\x03\x01\x00î\x01\x00\x00ê\x03\x03\x9cø\x98\x9dOÅ1\x06Oë\x83?ÀÃbUÆöë³\rµø³\x16Íu\x11'
    Forbidden (Permission denied): /
    Traceback (most recent call last):
    File "/usr/local/lib/python3.13/site-packages/django/core/handlers/exception.py", line 55, in inner
    17 replies  •  2025-02-24 20:22:47 +08:00
    pureGirl
    pureGirl
    OP
    Feb 24, 2025
    1
    是这个云安全性不好吗,应该怎么解决这个问题
    pota
    pota
    Feb 24, 2025
    2
    安全组开白
    tf2
    tf2
    Feb 24, 2025❤️4
    3
    你铺面开临街,还担心过往人流量多?
    CheckMySoul
    CheckMySoul
    Feb 24, 2025❤️1
    4
    暴露在公网上的内部服务?有固定 ip 就安全组加白名单,要么见一个恶意 ip 屏蔽一个,付费的话就云防火墙+云安全中心+WAF 。
    MFWT
    MFWT
    Feb 24, 2025
    5
    互联网噪音,很正常,都是脚本批量扫全网
    建议反向利用一下,根据恶意请求未雨绸缪修补/防止漏洞
    daimaosix
    daimaosix
    Feb 24, 2025
    6
    你公开访问必然被扫,都一样。既然是内部服务,为何不安全组加白?见过太多安全组全开放的,基本的安全意识都没得。
    RinGress
    RinGress
    Feb 24, 2025
    7
    公网 v4 必被扫
    我本地 v4 ,DNS 上加个子域名,1 分钟就看到 waf 上有 IP 过来扫这个域名了。ip 被扫那更是日常
    foolishcrab
    foolishcrab
    Feb 24, 2025 via iPhone
    8
    感觉你缺乏基本的运维知识,可以系统了解下企业云上部署结构,花不了几个小时
    opengps
    opengps
    Feb 24, 2025
    9
    这就是公网环境,完全正常的现象
    importmeta
    importmeta
    Feb 24, 2025
    10
    正常啊, 我经常看我服务器日志, 各种扫描器, 爆破, IP 全都不固定, 不用理会就行了.
    layxy
    layxy
    Feb 24, 2025
    11
    公网服务谁都可以访问,这种正常,只要不是 ddos 攻击问题不大,有很多外部扫描挖掘漏洞的(有很多勒索软件也会扫)
    usernametoolong
    usernametoolong
    Feb 24, 2025❤️1
    12
    现在搞网站的都退化到基础问题都不会搞了吗
    luodichen
    luodichen
    Feb 24, 2025
    13
    /robots.txt
    /sitemap.xml

    这些可不是恶意请求。
    PureWhiteWu
    PureWhiteWu
    Feb 24, 2025
    14
    公网可访问还是不可访问?
    MoeMoesakura
    MoeMoesakura
    Feb 24, 2025 via Android
    15
    Nginx 在外面反代一层就是了
    justfun
    justfun
    Feb 24, 2025
    16
    只要是公网 IP 都会被扫
    opengps
    opengps
    Feb 24, 2025
    17
    @luodichen 不完全,有些分析过程就是用 reobos 来获得后台隐藏路径的做法
    About   ·   Help   ·   Advertise   ·   Blog   ·   API   ·   FAQ   ·   Privacy   ·   Solana   ·   734 Online   Highest 6679   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 49ms · UTC 19:43 · PVG 03:43 · LAX 11:43 · JFK 14:43
    ♥ Do have faith in what you're doing.