在 debian 服务器上运行 apache,我开始监视日志,并发现了一些奇怪的事件。有谁知道这个 any-request-allowed.com 站点试图做什么......以及我如何阻止这种潜在的恶意流量?
消毒日志:
[46.161.11.245] - [13/Apr/2011:13:02:09 -0700] | api.goolertech.com "POST http://myinfo.any-request-allowed.com/?strGet=get2566 HTTP/1.1" 404 294 | -
[46.161.11.245] - [15/Apr/2011:13:02:53 -0700] | api.goolertech.com "POST http://myinfo.any-request-allowed.com/?strGet=get8888 HTTP/1.1" 404 294 | -
[46.161.11.245] - [17/Apr/2011:13:05:04 -0700] | api.goolertech.com "POST http://myinfo.any-request-allowed.com/?strGet=get9659 HTTP/1.1" 404 294 | -
Run Code Online (Sandbox Code Playgroud)
其中 404 是错误代码,294 是响应的大小。
编辑:
做了一个数据包捕获,这是我得到的请求:
POST http://myinfo.any-request-allowed.com/?strGet=get2566 HTTP/1.1
Host: myinfo.any-request-allowed.com
Pragma: no-cache
Accept: */*
Proxy-Connection: Keep-Alive
Cookie: strCookie=cookie2566
Content-Length: 16
Content-Type: application/x-www-form-urlencoded
strPost=post2566
Run Code Online (Sandbox Code Playgroud)