【待反馈】网站被恶意攻击

各位朋友，

网站日志查看，都是这种日志：

150.138.149.200 - - [23/Mar/2023:21:17:37 +0800] ＂GET /?a=0rwam/page/2/page/3260/page/3274/page/3274/page/3273/page/3276/page/2/page/3304/page/2/page/3304/page/3/page/3308/page/3308/page/3560/page/3/page/3593/page/2/page/2/page/3594/page/3595/page/2/page/3597/page/3597/page/3598/page/2/page/3599/page/3599/page/3612/page/3638 HTTP/1.1＂ 200 12198 ＂https://domain/?a=0rwam%2Fpage%2F2%2Fpage%2F3260%2Fpage%2F3274%2Fpage%2F3274%2Fpage%2F3273%2Fpage%2F3276%2Fpage%2F2%2Fpage%2F3304%2Fpage%2F2%2Fpage%2F3304%2Fpage%2F3%2Fpage%2F3308%2Fpage%2F3308%2Fpage%2F3560%2Fpage%2F3%2Fpage%2F3593%2Fpage%2F2%2Fpage%2F2%2Fpage%2F3594%2Fpage%2F3595%2Fpage%2F2%2Fpage%2F3597%2Fpage%2F3597%2Fpage%2F3598%2Fpage%2F2%2Fpage%2F3599%2Fpage%2F3599%2Fpage%2F3612＂ ＂Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Mobile Safari/537.36＂

150.138.149.155 - - [23/Mar/2023:21:17:37 +0800] ＂GET /?a=0rwam/page/2/page/3260/page/3274/page/3274/page/3273/page/3276/page/2/page/3304/page/2/page/3304/page/3/page/3308/page/3308/page/3560/page/3/page/3593/page/2/page/2/page/3594/page/3595/page/2/page/3597/page/3597/page/3598/page/3599/page/3599/page/3598/page/3603/page/3602/page/3603/page/2/page/2/page/2/page/2/page/2/page/2/page/2/page/3642/page/3647 HTTP/1.1＂ 200 12198 ＂https://domain/?a=0rwam%2Fpage%2F2%2Fpage%2F3260%2Fpage%2F3274%2Fpage%2F3274%2Fpage%2F3273%2Fpage%2F3276%2Fpage%2F2%2Fpage%2F3304%2Fpage%2F2%2Fpage%2F3304%2Fpage%2F3%2Fpage%2F3308%2Fpage%2F3308%2Fpage%2F3560%2Fpage%2F3%2Fpage%2F3593%2Fpage%2F2%2Fpage%2F2%2Fpage%2F3594%2Fpage%2F3595%2Fpage%2F2%2Fpage%2F3597%2Fpage%2F3597%2Fpage%2F3598%2Fpage%2F3599%2Fpage%2F3599%2Fpage%2F3598%2Fpage%2F3603%2Fpage%2F3602%2Fpage%2F3603%2Fpage%2F2%2Fpage%2F2%2Fpage%2F2%2Fpage%2F2%2Fpage%2F2%2Fpage%2F2%2Fpage%2F2%2Fpage%2F3642＂ ＂Mozilla/5.0 (Linux; Android 5.0; SM-G900P Build/LRX21T) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Mobile Safari/537.36＂

这样导致服务器的负载非常高，内存和cpu都是100%。

这种可以通过防火墙规则过滤掉吗？

谢谢了。

SM-G900P Build
把这个放到nginx防火墙黑名单中

您好：

我这里好像没有UA黑名单，这个UA黑名单，是不是只有收费版才有。



谢谢。

大炮运维V587 发表于 2023-3-23 21:33
SM-G900P Build
把这个放到nginx防火墙黑名单中

是不是只有收费版才有，免费版好像没看到UA黑名单功能。

qiuzhang 发表于 2023-3-23 23:06
是不是只有收费版才有，免费版好像没看到UA黑名单功能。

是的

大炮运维V587 发表于 2023-3-23 23:40
是的

我想确认一下，您说的这个规则确认可以解决web攻击的问题。

如果确认可以我可以购买收费版的防火墙。

主要是怕购买了不能解决问题。

谢谢。

qiuzhang 发表于 2023-3-23 23:45
我想确认一下，您说的这个规则确认可以解决web攻击的问题。

如果确认可以我可以购买收费版的防火墙。

可以联系下客服，说明情况后，会赠送你一张企业版的体验券，包含了付费防火墙的使用的