当我检查nginx access.log时，未知的HEAD请求会定期进入

时间：2017-07-14 01:17:46

标签： django amazon-web-services nginx

首先，我使用服务器环境：

  1. 服务器：nginx + uwsgi + django app，docker + AWS ECS deploy
  2. 芹菜：rabbitmq ec2
  3. cache：redis ec2
  4. 日志记录：AWS CloudWatch日志+了望塔第三方应用

    5. 当我访问ECS EC2并检查nginx access.log时，会定期提出以下请求 为什么这个要求来找我？这是第一次打开服务器时出现的情况。

    此外，我的ecs服务器的安全组80/443端口可以在任何地方打开。

    的nginx / access.log的

    54.214.101.194 - - [14/Jul/2017:03:02:12 +0000] "HEAD http://13.114.17.75:80/mysql/admin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:12 +0000] "HEAD http://13.114.17.75:80/mysql/dbadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:12 +0000] "HEAD http://13.114.17.75:80/mysql/sqlmanager/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:12 +0000] "HEAD http://13.114.17.75:80/mysql/mysqlmanager/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:13 +0000] "HEAD http://13.114.17.75:80/phpmyadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:13 +0000] "HEAD http://13.114.17.75:80/phpMyadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:13 +0000] "HEAD http://13.114.17.75:80/phpMyAdmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:13 +0000] "HEAD http://13.114.17.75:80/phpmyAdmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:13 +0000] "HEAD http://13.114.17.75:80/phpmyadmin2/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:13 +0000] "HEAD http://13.114.17.75:80/phpmyadmin3/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:13 +0000] "HEAD http://13.114.17.75:80/phpmyadmin4/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:13 +0000] "HEAD http://13.114.17.75:80/2phpmyadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:13 +0000] "HEAD http://13.114.17.75:80/wp-content/plugins/portable-phpmyadmin/wp-pma-mod/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:13 +0000] "HEAD http://13.114.17.75:80/phpmy/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:14 +0000] "HEAD http://13.114.17.75:80/phppma/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:14 +0000] "HEAD http://13.114.17.75:80/myadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:14 +0000] "HEAD http://13.114.17.75:80/shopdb/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:14 +0000] "HEAD http://13.114.17.75:80/MyAdmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:14 +0000] "HEAD http://13.114.17.75:80/program/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:14 +0000] "HEAD http://13.114.17.75:80/PMA/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:14 +0000] "HEAD http://13.114.17.75:80/dbadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:14 +0000] "HEAD http://13.114.17.75:80/pma/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:14 +0000] "HEAD http://13.114.17.75:80/db/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:15 +0000] "HEAD http://13.114.17.75:80/admin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:15 +0000] "HEAD http://13.114.17.75:80/mysql/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:15 +0000] "HEAD http://13.114.17.75:80/database/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:15 +0000] "HEAD http://13.114.17.75:80/db/phpmyadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:15 +0000] "HEAD http://13.114.17.75:80/db/phpMyAdmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:15 +0000] "HEAD http://13.114.17.75:80/sqlmanager/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:15 +0000] "HEAD http://13.114.17.75:80/mysqlmanager/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:15 +0000] "HEAD http://13.114.17.75:80/php-myadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:15 +0000] "HEAD http://13.114.17.75:80/phpmy-admin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:16 +0000] "HEAD http://13.114.17.75:80/mysqladmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:16 +0000] "HEAD http://13.114.17.75:80/mysql-admin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:16 +0000] "HEAD http://13.114.17.75:80/admin/phpmyadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:16 +0000] "HEAD http://13.114.17.75:80/admin/phpMyAdmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:16 +0000] "HEAD http://13.114.17.75:80/admin/sysadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:16 +0000] "HEAD http://13.114.17.75:80/admin/sqladmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:16 +0000] "HEAD http://13.114.17.75:80/admin/db/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:16 +0000] "HEAD http://13.114.17.75:80/admin/web/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:16 +0000] "HEAD http://13.114.17.75:80/admin/pMA/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:17 +0000] "HEAD http://13.114.17.75:80/mysql/pma/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:17 +0000] "HEAD http://13.114.17.75:80/mysql/db/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:17 +0000] "HEAD http://13.114.17.75:80/mysql/web/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:17 +0000] "HEAD http://13.114.17.75:80/mysql/pMA/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:17 +0000] "HEAD http://13.114.17.75:80/sql/phpmanager/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:17 +0000] "HEAD http://13.114.17.75:80/sql/php-myadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:17 +0000] "HEAD http://13.114.17.75:80/sql/phpmy-admin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:17 +0000] "HEAD http://13.114.17.75:80/sql/sql/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:17 +0000] "HEAD http://13.114.17.75:80/sql/myadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:18 +0000] "HEAD http://13.114.17.75:80/sql/webadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:18 +0000] "HEAD http://13.114.17.75:80/sql/sqlweb/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:18 +0000] "HEAD http://13.114.17.75:80/sql/websql/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:18 +0000] "HEAD http://13.114.17.75:80/sql/webdb/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:18 +0000] "HEAD http://13.114.17.75:80/sql/sqladmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:18 +0000] "HEAD http://13.114.17.75:80/sql/sql-admin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:18 +0000] "HEAD http://13.114.17.75:80/sql/phpmyadmin2/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:18 +0000] "HEAD http://13.114.17.75:80/sql/phpMyAdmin2/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:18 +0000] "HEAD http://13.114.17.75:80/sql/phpMyAdmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:19 +0000] "HEAD http://13.114.17.75:80/db/myadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:19 +0000] "HEAD http://13.114.17.75:80/db/webadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:19 +0000] "HEAD http://13.114.17.75:80/db/dbweb/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:19 +0000] "HEAD http://13.114.17.75:80/db/websql/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:19 +0000] "HEAD http://13.114.17.75:80/db/webdb/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:19 +0000] "HEAD http://13.114.17.75:80/db/dbadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:19 +0000] "HEAD http://13.114.17.75:80/db/db-admin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:19 +0000] "HEAD http://13.114.17.75:80/db/phpmyadmin3/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:19 +0000] "HEAD http://13.114.17.75:80/db/phpMyAdmin3/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:20 +0000] "HEAD http://13.114.17.75:80/db/phpMyAdmin-3/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:20 +0000] "HEAD http://13.114.17.75:80/administrator/phpmyadmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:20 +0000] "HEAD http://13.114.17.75:80/administrator/phpMyAdmin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:20 +0000] "HEAD http://13.114.17.75:80/administrator/db/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:20 +0000] "HEAD http://13.114.17.75:80/administrator/web/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:20 +0000] "HEAD http://13.114.17.75:80/administrator/pma/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:20 +0000] "HEAD http://13.114.17.75:80/administrator/PMA/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:20 +0000] "HEAD http://13.114.17.75:80/administrator/admin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:20 +0000] "HEAD http://13.114.17.75:80/phpMyAdmin2/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:20 +0000] "HEAD http://13.114.17.75:80/phpMyAdmin3/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:21 +0000] "HEAD http://13.114.17.75:80/phpMyAdmin4/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:21 +0000] "HEAD http://13.114.17.75:80/phpMyAdmin-3/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:21 +0000] "HEAD http://13.114.17.75:80/php-my-admin/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:21 +0000] "HEAD http://13.114.17.75:80/PMA2011/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:21 +0000] "HEAD http://13.114.17.75:80/PMA2012/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:21 +0000] "HEAD http://13.114.17.75:80/PMA2013/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:21 +0000] "HEAD http://13.114.17.75:80/PMA2014/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:21 +0000] "HEAD http://13.114.17.75:80/PMA2015/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:21 +0000] "HEAD http://13.114.17.75:80/PMA2016/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:22 +0000] "HEAD http://13.114.17.75:80/PMA2017/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:22 +0000] "HEAD http://13.114.17.75:80/PMA2018/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:22 +0000] "HEAD http://13.114.17.75:80/pma2011/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:22 +0000] "HEAD http://13.114.17.75:80/pma2012/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:22 +0000] "HEAD http://13.114.17.75:80/pma2013/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:22 +0000] "HEAD http://13.114.17.75:80/pma2014/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:22 +0000] "HEAD http://13.114.17.75:80/pma2015/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:22 +0000] "HEAD http://13.114.17.75:80/pma2016/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:22 +0000] "HEAD http://13.114.17.75:80/pma2017/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:23 +0000] "HEAD http://13.114.17.75:80/pma2018/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:23 +0000] "HEAD http://13.114.17.75:80/phpmyadmin2011/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:23 +0000] "HEAD http://13.114.17.75:80/phpmyadmin2012/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:23 +0000] "HEAD http://13.114.17.75:80/phpmyadmin2013/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:23 +0000] "HEAD http://13.114.17.75:80/phpmyadmin2015/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:23 +0000] "HEAD http://13.114.17.75:80/phpmyadmin2016/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:23 +0000] "HEAD http://13.114.17.75:80/phpmyadmin2017/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:24 +0000] "HEAD http://13.114.17.75:80/phpmyadmin2018/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
54.214.101.194 - - [14/Jul/2017:03:02:24 +0000] "HEAD http://13.114.17.75:80/phpmanager/ HTTP/1.1" 404 0 "-" "Mozilla/5.0 Jorgee"
95.213.177.125 - - [14/Jul/2017:03:14:35 +0000] "POST /azenv.php?auth=150000207593&a=PSCMN&i=885409785&p=80 HTTP/1.1" 404 580 "https://proxyradar.com/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)"

1 个答案:

答案 0 :(得分：10)

这是漏洞扫描工具ZmEu中非常典型的请求模式。长话短说，黑客正在运行一个自动化工具，试图在您的系统上找到PHPMyAdmin的易受攻击的安装，以利用它来获得对系统的root访问权限。你系统上没有PHPMyAdmin并不重要，他们仍然会提出要求进行测试，看看你是否这么做，因为这样做很便宜，如果他们确实找到了可以利用的东西，可以进入你的服务器来窃取数据或将其用于恶意目的。

不幸的是，这只是在互联网上安装服务器的成本，人们不断地针对他们可以到达的任何服务器运行自动扫描工具，试图找到入侵它并接管它的方法。

相关问题
最新问题