奇怪的日志内容

[Hardrain]

最近几天 HTTP 服务器的日志里出现了一些奇怪的请求 METHOD 都是 HEAD，请求的都是根目录下的、名称包含中文的、实际不存在(返回 HTTP 404)的压缩文件

比如

2002:b612:869::b612:869 - - [28/Jul/2017:06:16:09 +0000]
Request:"HEAD /\xd0\xc2\xbd\xa8%20WinRAR%20\xd1\xb9\xcb\xf5\xce\xc4\xbc\xfe.rar HTTP/1.1"
Scheme:http 301 Sent:224 Bytes
Referer:"-"
UA:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)"

182.18.8.105 - - [28/Jul/2017:06:16:09 +0000]
Request:"HEAD /%d0%c2%bd%a8%20WinRAR%20%d1%b9%cb%f5%ce%c4%bc%fe.rar HTTP/1.1"
Scheme:https 404 Sent:677 Bytes
Referer:"-"
UA:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)"

2002:b612:869::b612:869 - - [28/Jul/2017:06:16:10 +0000]
Request:"HEAD /\xb8\xb4\xbc\xfe%20websoft.zip HTTP/1.1"
Scheme:http 301 Sent:198 Bytes
Referer:"-"
UA:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)"

182.18.8.105 - - [28/Jul/2017:06:16:10 +0000]
Request:"HEAD /%b8%b4%bc%fe%20websoft.zip HTTP/1.1"
Scheme:https 404 Sent:677 Bytes
Referer:"-"
UA:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)"

2002:b612:869::b612:869 - - [28/Jul/2017:06:16:11 +0000]
Request:"HEAD /\xb8\xb4\xbc\xfe%20website.rar HTTP/1.1"
Scheme:http 301 Sent:198 Bytes
Referer:"-"
UA:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)"

182.18.8.105 - - [28/Jul/2017:06:16:11 +0000]
Request:"HEAD /%b8%b4%bc%fe%20website.rar HTTP/1.1"
Scheme:https 404 Sent:677 Bytes
Referer:"-"
UA:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)"

2002:b612:869::b612:869 - - [28/Jul/2017:06:16:12 +0000]
Request:"HEAD /\xb8\xb4\xbc\xfe%20web.zip HTTP/1.1"
Scheme:http 301 Sent:194 Bytes
Referer:"-"
UA:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)"

182.18.8.105 - - [28/Jul/2017:06:16:12 +0000]
Request:"HEAD /%b8%b4%bc%fe%20web.zip HTTP/1.1"
Scheme:https 404 Sent:677 Bytes
Referer:"-"
UA:"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)"

Google 了一下 Request 里的路径，只找到一条有效结果 https://www.wormclassroom.org/vhosts/TRASH/imagej.net/awstats/awstats032016.imagej.net.txt 这网站用的还是个无效的证书.

[torbrowserbridge]

嗅探用的吧

[torbrowserbridge]

有些人喜欢把网站整体打包备份在网站访问路径下，这些嗅探工具可以嗅探到下载下来。然后就可以干坏事了。

[xzem]

楼上，正解。

[flynaj]

就是扫描你的文件存在就下载，HEAD 是降低你的服务器压力，方便扫描

[Hardrain]

@torbrowserbridge 可我觉得 作为一个 Wordpress(PHP+MySQL)站

比起站点文件的备份
他会对.sql 文件更感兴趣吧……

不过这个理解的确挺合理的.

[Hardrain]

@flynaj 看到 20x 不是 4xx 就 GET 了？

[flynaj]

@Hardrain
机器扫描就是这样，确实是 20x 就 get，都是无脑扫

[torbrowserbridge]

@flynaj 不是为了降低你的服务器压力，是为了更快的获得结果。