V2EX = way to explore
V2EX 是一个关于分享和探索的地方
Sign Up Now
For Existing Member  Sign In
pureGirl

部署在云上内部使用的服务一直有 ip 恶意请求

  •  
  •   pureGirl · Feb 24, 2025 · 4087 views
    This topic created in 430 days ago, the information mentioned may be changed or developed.
    跟丧尸围城一样
    django.core.exceptions.DisallowedHost: Invalid HTTP_HOST header: '123456.czxcz.cn:8000'. You may need to add '123456.czxcz.cn' to ALLOWED_HOSTS.
    Invalid HTTP_HOST header: '123456.czxcz.cn:8000'. You may need to add '123456.czxcz.cn' to ALLOWED_HOSTS.
    Traceback (most recent call last):
    File "/usr/local/lib/python3.13/site-packages/django/core/handlers/exception.py", line 55, in inner
    response = get_response(request)
    File "/usr/local/lib/python3.13/site-packages/django/utils/deprecation.py", line 128, in __call__
    response = self.process_request(request)
    File "/usr/local/lib/python3.13/site-packages/django/middleware/common.py", line 48, in process_request
    host = request.get_host()
    File "/usr/local/lib/python3.13/site-packages/django/http/request.py", line 151, in get_host
    raise DisallowedHost(msg)
    django.core.exceptions.DisallowedHost: Invalid HTTP_HOST header: '123456.czxcz.cn:8000'. You may need to add '123456.czxcz.cn' to ALLOWED_HOSTS.
    Bad Request: /robots.txt
    Bad Request: /robots.txt
    Invalid HTTP_HOST header: '123456.czxcz.cn:8000'. You may need to add '123456.czxcz.cn' to ALLOWED_HOSTS.
    Traceback (most recent call last):
    File "/usr/local/lib/python3.13/site-packages/django/core/handlers/exception.py", line 55, in inner
    response = get_response(request)
    File "/usr/local/lib/python3.13/site-packages/django/utils/deprecation.py", line 128, in __call__
    response = self.process_request(request)
    File "/usr/local/lib/python3.13/site-packages/django/middleware/common.py", line 48, in process_request
    host = request.get_host()
    File "/usr/local/lib/python3.13/site-packages/django/http/request.py", line 151, in get_host
    raise DisallowedHost(msg)
    django.core.exceptions.DisallowedHost: Invalid HTTP_HOST header: '123456.czxcz.cn:8000'. You may need to add '123456.czxcz.cn' to ALLOWED_HOSTS.
    Invalid HTTP_HOST header: '123456.czxcz.cn:8000'. You may need to add '123456.czxcz.cn' to ALLOWED_HOSTS.
    Traceback (most recent call last):
    File "/usr/local/lib/python3.13/site-packages/django/core/handlers/exception.py", line 55, in inner
    response = get_response(request)
    File "/usr/local/lib/python3.13/site-packages/django/utils/deprecation.py", line 128, in __call__
    response = self.process_request(request)
    File "/usr/local/lib/python3.13/site-packages/django/middleware/common.py", line 48, in process_request
    host = request.get_host()
    File "/usr/local/lib/python3.13/site-packages/django/http/request.py", line 151, in get_host
    raise DisallowedHost(msg)
    django.core.exceptions.DisallowedHost: Invalid HTTP_HOST header: '123456.czxcz.cn:8000'. You may need to add '123456.czxcz.cn' to ALLOWED_HOSTS.
    Bad Request: /sitemap.xml
    Bad Request: /sitemap.xml
    [2025-02-24 04:01:19 +0800] [17] [WARNING] Invalid request from ip=43.158.213.246: Invalid HTTP request line: '\x16\x03\x01\x00Ã\x01\x00\x00¿\x03\x03~Å]Æø¡ô\x88©}à\x91\x7f¶3p\x11¹öôæË2¡±_¨;@Ë0£\x00\x00\x1aÀ/À+À\x11À\x07À\x13À\tÀ\x14À\n\x00\x05\x00/\x005À\x12\x00\n\x01\x00\x00|\x00\x05\x00\x05\x01\x00\x00\x00\x00\x00\n\x00\x08\x00\x06\x00\x17\x00\x18\x00\x19\x00\x0b\x00\x02\x01\x00\x00#\x00\x00\x00\r\x00&\x00$\x06\x01\x06\x03\x06\x02\x05\x01\x05\x03\x05\x02\x04\x01\x04\x03\x04\x02\x03\x01\x03\x03\x03\x02\x02\x01\x02\x03\x02\x02\x01\x01\x01\x03\x01\x02ÿ\x01\x00\x01\x00\x00(\x00"\x00 a%/k\x00T$\x83\x0eç½6¡©À\x97\x8fEÐ'
    [2025-02-24 04:02:26 +0800] [18] [WARNING] Invalid request from ip=43.158.213.246: Invalid HTTP request line: '\x16\x03\x01\x00î\x01\x00\x00ê\x03\x03\x9cø\x98\x9dOÅ1\x06Oë\x83?ÀÃbUÆöë³\rµø³\x16Íu\x11'
    Forbidden (Permission denied): /
    Traceback (most recent call last):
    File "/usr/local/lib/python3.13/site-packages/django/core/handlers/exception.py", line 55, in inner
    17 replies    2025-02-24 20:22:47 +08:00
    pureGirl
        1
    pureGirl  
    OP
       Feb 24, 2025
    是这个云安全性不好吗,应该怎么解决这个问题
    pota
        2
    pota  
       Feb 24, 2025
    安全组开白
    tf2
        3
    tf2  
       Feb 24, 2025   ❤️ 4
    你铺面开临街,还担心过往人流量多?
    CheckMySoul
        4
    CheckMySoul  
       Feb 24, 2025   ❤️ 1
    暴露在公网上的内部服务?有固定 ip 就安全组加白名单,要么见一个恶意 ip 屏蔽一个,付费的话就云防火墙+云安全中心+WAF 。
    MFWT
        5
    MFWT  
       Feb 24, 2025
    互联网噪音,很正常,都是脚本批量扫全网
    建议反向利用一下,根据恶意请求未雨绸缪修补/防止漏洞
    daimaosix
        6
    daimaosix  
       Feb 24, 2025
    你公开访问必然被扫,都一样。既然是内部服务,为何不安全组加白?见过太多安全组全开放的,基本的安全意识都没得。
    RinGress
        7
    RinGress  
       Feb 24, 2025
    公网 v4 必被扫
    我本地 v4 ,DNS 上加个子域名,1 分钟就看到 waf 上有 IP 过来扫这个域名了。ip 被扫那更是日常
    foolishcrab
        8
    foolishcrab  
       Feb 24, 2025 via iPhone
    感觉你缺乏基本的运维知识,可以系统了解下企业云上部署结构,花不了几个小时
    opengps
        9
    opengps  
       Feb 24, 2025
    这就是公网环境,完全正常的现象
    importmeta
        10
    importmeta  
       Feb 24, 2025
    正常啊, 我经常看我服务器日志, 各种扫描器, 爆破, IP 全都不固定, 不用理会就行了.
    layxy
        11
    layxy  
       Feb 24, 2025
    公网服务谁都可以访问,这种正常,只要不是 ddos 攻击问题不大,有很多外部扫描挖掘漏洞的(有很多勒索软件也会扫)
    usernametoolong
        12
    usernametoolong  
       Feb 24, 2025   ❤️ 1
    现在搞网站的都退化到基础问题都不会搞了吗
    luodichen
        13
    luodichen  
       Feb 24, 2025
    /robots.txt
    /sitemap.xml

    这些可不是恶意请求。
    PureWhiteWu
        14
    PureWhiteWu  
       Feb 24, 2025
    公网可访问还是不可访问?
    MoeMoesakura
        15
    MoeMoesakura  
       Feb 24, 2025 via Android
    Nginx 在外面反代一层就是了
    justfun
        16
    justfun  
       Feb 24, 2025
    只要是公网 IP 都会被扫
    opengps
        17
    opengps  
       Feb 24, 2025
    @luodichen 不完全,有些分析过程就是用 reobos 来获得后台隐藏路径的做法
    About   ·   Help   ·   Advertise   ·   Blog   ·   API   ·   FAQ   ·   Solana   ·   857 Online   Highest 6679   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 106ms · UTC 22:01 · PVG 06:01 · LAX 15:01 · JFK 18:01
    ♥ Do have faith in what you're doing.