从access.log,我发现了奇怪的访问模式。这种探索的目的是什么?
219.106.219.16 - - [11/Mar/2016:15:00:14 +0200] "HEAD my.aws.ec2.instance:80/1phpmyadmin/ HTTP/1.1" 404 195 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:14 +0200] "HEAD my.aws.ec2.instance:80/2phpmyadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:14 +0200] "HEAD my.aws.ec2.instance:80/3phpmyadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:15 +0200] "HEAD my.aws.ec2.instance:80/4phpmyadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:15 +0200] "HEAD my.aws.ec2.instance:80/MyAdmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:15 +0200] "HEAD my.aws.ec2.instance:80/PMA/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:15 +0200] "HEAD my.aws.ec2.instance:80/PMA2011/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:16 +0200] "HEAD my.aws.ec2.instance:80/PMA2012/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:16 +0200] "HEAD my.aws.ec2.instance:80/PMA2013/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:16 +0200] "HEAD my.aws.ec2.instance:80/PMA2014/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:17 +0200] "HEAD my.aws.ec2.instance:80/PMA2015/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:17 +0200] "HEAD my.aws.ec2.instance:80/admin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:17 +0200] "HEAD my.aws.ec2.instance:80/admin/db/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:17 +0200] "HEAD my.aws.ec2.instance:80/admin/pMA/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:18 +0200] "HEAD my.aws.ec2.instance:80/admin/phpMyAdmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:18 +0200] "HEAD my.aws.ec2.instance:80/admin/phpmyadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:18 +0200] "HEAD my.aws.ec2.instance:80/admin/sqladmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:19 +0200] "HEAD my.aws.ec2.instance:80/admin/sysadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:19 +0200] "HEAD my.aws.ec2.instance:80/admin/web/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:19 +0200] "HEAD my.aws.ec2.instance:80/administrator/PMA/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:19 +0200] "HEAD my.aws.ec2.instance:80/administrator/admin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:20 +0200] "HEAD my.aws.ec2.instance:80/administrator/db/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:20 +0200] "HEAD my.aws.ec2.instance:80/administrator/phpMyAdmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:20 +0200] "HEAD my.aws.ec2.instance:80/administrator/phpmyadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:20 +0200] "HEAD my.aws.ec2.instance:80/administrator/pma/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:21 +0200] "HEAD my.aws.ec2.instance:80/administrator/web/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:21 +0200] "HEAD my.aws.ec2.instance:80/database/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:21 +0200] "HEAD my.aws.ec2.instance:80/db/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:22 +0200] "HEAD my.aws.ec2.instance:80/db/db-admin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:22 +0200] "HEAD my.aws.ec2.instance:80/db/dbadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:22 +0200] "HEAD my.aws.ec2.instance:80/db/dbweb/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:22 +0200] "HEAD my.aws.ec2.instance:80/db/myadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:23 +0200] "HEAD my.aws.ec2.instance:80/db/phpMyAdmin-3/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:23 +0200] "HEAD my.aws.ec2.instance:80/db/phpMyAdmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:23 +0200] "HEAD my.aws.ec2.instance:80/db/phpMyAdmin3/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:24 +0200] "HEAD my.aws.ec2.instance:80/db/phpmyadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:24 +0200] "HEAD my.aws.ec2.instance:80/db/phpmyadmin3/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:24 +0200] "HEAD my.aws.ec2.instance:80/db/webadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:24 +0200] "HEAD my.aws.ec2.instance:80/db/webdb/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:25 +0200] "HEAD my.aws.ec2.instance:80/db/websql/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:25 +0200] "HEAD my.aws.ec2.instance:80/dbadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:25 +0200] "HEAD my.aws.ec2.instance:80/myadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:26 +0200] "HEAD my.aws.ec2.instance:80/myadminphp/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:26 +0200] "HEAD my.aws.ec2.instance:80/mysql-admin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:26 +0200] "HEAD my.aws.ec2.instance:80/mysql/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:26 +0200] "HEAD my.aws.ec2.instance:80/mysql/admin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:27 +0200] "HEAD my.aws.ec2.instance:80/mysql/db/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:27 +0200] "HEAD my.aws.ec2.instance:80/mysql/dbadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:27 +0200] "HEAD my.aws.ec2.instance:80/mysql/mysqlmanager/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:27 +0200] "HEAD my.aws.ec2.instance:80/mysql/pMA/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:28 +0200] "HEAD my.aws.ec2.instance:80/mysql/pma/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:28 +0200] "HEAD my.aws.ec2.instance:80/mysql/sqlmanager/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:28 +0200] "HEAD my.aws.ec2.instance:80/mysql/web/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:29 +0200] "HEAD my.aws.ec2.instance:80/mysqladmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:29 +0200] "HEAD my.aws.ec2.instance:80/mysqlmanager/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:29 +0200] "HEAD my.aws.ec2.instance:80/php-my-admin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:29 +0200] "HEAD my.aws.ec2.instance:80/php-myadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:30 +0200] "HEAD my.aws.ec2.instance:80/phpMyAdmin-2/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:30 +0200] "HEAD my.aws.ec2.instance:80/phpMyAdmin-3/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:30 +0200] "HEAD my.aws.ec2.instance:80/phpMyAdmin-4/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:31 +0200] "HEAD my.aws.ec2.instance:80/phpMyAdmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:31 +0200] "HEAD my.aws.ec2.instance:80/phpMyAdmin2/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:31 +0200] "HEAD my.aws.ec2.instance:80/phpMyAdmin3/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:31 +0200] "HEAD my.aws.ec2.instance:80/phpMyAdmin4/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:32 +0200] "HEAD my.aws.ec2.instance:80/phpMyadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:32 +0200] "HEAD my.aws.ec2.instance:80/phpmanager/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:32 +0200] "HEAD my.aws.ec2.instance:80/phpmy-admin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:32 +0200] "HEAD my.aws.ec2.instance:80/phpmy/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:33 +0200] "HEAD my.aws.ec2.instance:80/phpmyAdmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:33 +0200] "HEAD my.aws.ec2.instance:80/phpmyadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:33 +0200] "HEAD my.aws.ec2.instance:80/phpmyadmin1/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:34 +0200] "HEAD my.aws.ec2.instance:80/phpmyadmin2/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:34 +0200] "HEAD my.aws.ec2.instance:80/phpmyadmin3/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:34 +0200] "HEAD my.aws.ec2.instance:80/phpmyadmin4/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:34 +0200] "HEAD my.aws.ec2.instance:80/phppma/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:35 +0200] "HEAD my.aws.ec2.instance:80/pma/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:35 +0200] "HEAD my.aws.ec2.instance:80/pma2011/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:35 +0200] "HEAD my.aws.ec2.instance:80/pma2012/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:36 +0200] "HEAD my.aws.ec2.instance:80/pma2013/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:36 +0200] "HEAD my.aws.ec2.instance:80/pma2014/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:36 +0200] "HEAD my.aws.ec2.instance:80/pma2015/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:36 +0200] "HEAD my.aws.ec2.instance:80/program/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:37 +0200] "HEAD my.aws.ec2.instance:80/shopdb/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:37 +0200] "HEAD my.aws.ec2.instance:80/sql/myadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:37 +0200] "HEAD my.aws.ec2.instance:80/sql/php-myadmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:38 +0200] "HEAD my.aws.ec2.instance:80/sql/phpMyAdmin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:38 +0200] "HEAD my.aws.ec2.instance:80/sql/phpMyAdmin2/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:38 +0200] "HEAD my.aws.ec2.instance:80/sql/phpMyAdmin3/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:38 +0200] "HEAD my.aws.ec2.instance:80/sql/phpMyAdmin4/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:39 +0200] "HEAD my.aws.ec2.instance:80/sql/phpmanager/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:39 +0200] "HEAD my.aws.ec2.instance:80/sql/phpmy-admin/ HTTP/1.1" 404 194 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:39 +0200] "HEAD my.aws.ec2.instance:80/sql/phpmyadmin2/ HTTP/1.1" 404 193 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:39 +0200] "HEAD my.aws.ec2.instance:80/sql/phpmyadmin3/ HTTP/1.1" 404 193 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:40 +0200] "HEAD my.aws.ec2.instance:80/sql/phpmyadmin4/ HTTP/1.1" 404 193 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:40 +0200] "HEAD my.aws.ec2.instance:80/sql/sql-admin/ HTTP/1.1" 404 193 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:40 +0200] "HEAD my.aws.ec2.instance:80/sql/sql/ HTTP/1.1" 404 193 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:41 +0200] "HEAD my.aws.ec2.instance:80/sql/sqladmin/ HTTP/1.1" 404 193 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:41 +0200] "HEAD my.aws.ec2.instance:80/sql/sqlweb/ HTTP/1.1" 404 193 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:41 +0200] "HEAD my.aws.ec2.instance:80/sql/webadmin/ HTTP/1.1" 404 193 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:41 +0200] "HEAD my.aws.ec2.instance:80/sql/webdb/ HTTP/1.1" 404 193 "-" "Mozilla/5.0 Jorgee"
219.106.219.16 - - [11/Mar/2016:15:00:42 +0200] "HEAD my.aws.ec2.instance:80/sql/websql/ HTTP/1.1" 404 158 "-" "Mozilla/5.0 Jorgee"发布于 2016-03-11 15:43:56
任何公共互联网上的web服务器都会看到这种流量。
自动机器人抓取所有可能的IP地址,查找常见软件的易受攻击版本(包括但不限于phpMyAdmin、WordPress、Drupal、IIS利用等)。
发布于 2017-07-04 17:38:21
如果使用apache2,只需在.htaccess文件中包含以下行:
<IfModule mod_rewrite.c>
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} ^(.*)Jorgee$
RewriteRule .* - [F]
</IfModule>因此bot将收到403错误,并且请求不会转发到php应用程序(可能会打开数据库连接以响应404错误)。
https://stackoverflow.com/questions/35942018
复制相似问题