“黑灰产”恶意攻击高风险公网IP地址曝光台/黑名单库

15次阅读

互联网上形形色色，单纯好奇的，闲的发慌的，心怀恶意的……什么样的人都有。我无法持续跟踪攻击本小破站的背后之人究竟都有谁，肉鸡也好，跳板也罢，从今日起，只能把攻击本站的最后一跳公网 IP 在这里曝光了，算是给大家做个参考。如果您是所涉公网 IP 的电信运营商或 IDC 运营商工作人员，欢迎核实和处理相关网站违法违规行为。

1、日期：2024.08.17 高风险公网IP：143.92.34.18 归属地：中国香港 所属运营商：CTG Server Limited

恶意攻击行为：伪造成主流搜索引擎 UA 信息，执行 CC 攻击。

详细日志：

<pre>

143.92.34.18 – – [17/Aug/2024:09:53:16 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 200 415 ＂https://www.itylq.com＂＂iaskspider/2.0(+http://iask.com/help/help_index.html\xA1\xB1)＂
143.92.34.18 – – [17/Aug/2024:09:53:17 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Googlebot/2.1 (+http://www.googlebot.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:17 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂(compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html\xA3\xA9＂
143.92.34.18 – – [17/Aug/2024:09:53:17 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Googlebot/2.1 (+http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:18 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 200 415 ＂https://www.itylq.com＂＂Googlebot/2.1 (+http://www.googlebot.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:18 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 200 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:18 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 200 415 ＂https://www.itylq.com＂＂Sogou web spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07\xA1\xE5)＂
143.92.34.18 – – [17/Aug/2024:09:53:18 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp\xA1\xB1)＂
143.92.34.18 – – [17/Aug/2024:09:53:19 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; YodaoBot/1.0; http://www.yodao.com/help/webmaster/spider/\xA1\xB1; )＂
143.92.34.18 – – [17/Aug/2024:09:53:19 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 200 415 ＂https://www.itylq.com＂＂Googlebot/2.1 (+http://www.googlebot.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:19 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂iaskspider/2.0(+http://iask.com/help/help_index.html\xA1\xB1)＂
143.92.34.18 – – [17/Aug/2024:09:53:20 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; iaskspider/1.0; MSIE 6.0)＂
143.92.34.18 – – [17/Aug/2024:09:53:20 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂msnbot/1.0 (+http://search.msn.com/msnbot.htm\xA1\xB1)＂
143.92.34.18 – – [17/Aug/2024:09:53:21 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂(compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html\xA3\xA9＂
143.92.34.18 – – [17/Aug/2024:09:53:21 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:21 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂iaskspider/2.0(+http://iask.com/help/help_index.html\xA1\xB1)＂
143.92.34.18 – – [17/Aug/2024:09:53:21 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:22 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; YodaoBot/1.0; http://www.yodao.com/help/webmaster/spider/\xA1\xB1; )＂
143.92.34.18 – – [17/Aug/2024:09:53:22 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂msnbot/1.0 (+http://search.msn.com/msnbot.htm\xA1\xB1)＂
143.92.34.18 – – [17/Aug/2024:09:53:22 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Sogou web spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07\xA1\xE5)＂
143.92.34.18 – – [17/Aug/2024:09:53:22 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:23 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html\xA3\xA9＂
143.92.34.18 – – [17/Aug/2024:09:53:23 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:23 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Sogou web spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07\xA1\xE5)＂
143.92.34.18 – – [17/Aug/2024:09:53:24 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; YodaoBot/1.0; http://www.yodao.com/help/webmaster/spider/\xA1\xB1; )＂
143.92.34.18 – – [17/Aug/2024:09:53:24 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂AppleWebKit/534.46 (KHTML,like Gecko) Version/5.1 Mobile Safari/10600.6.3＂
143.92.34.18 – – [17/Aug/2024:09:53:24 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂(compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html\xA3\xA9＂
143.92.34.18 – – [17/Aug/2024:09:53:24 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:25 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂(compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html\xA3\xA9＂
143.92.34.18 – – [17/Aug/2024:09:53:25 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:25 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; YodaoBot/1.0; http://www.yodao.com/help/webmaster/spider/\xA1\xB1; )＂
143.92.34.18 – – [17/Aug/2024:09:53:25 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂(compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html\xA3\xA9＂
143.92.34.18 – – [17/Aug/2024:09:53:26 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:26 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Sogou web spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07\xA1\xE5)＂
143.92.34.18 – – [17/Aug/2024:09:53:26 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:27 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Sogou web spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07\xA1\xE5)＂
143.92.34.18 – – [17/Aug/2024:09:53:27 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂AppleWebKit/534.46 (KHTML,like Gecko) Version/5.1 Mobile Safari/10600.6.3＂
143.92.34.18 – – [17/Aug/2024:09:53:27 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:27 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; YodaoBot/1.0; http://www.yodao.com/help/webmaster/spider/\xA1\xB1; )＂
143.92.34.18 – – [17/Aug/2024:09:53:28 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Googlebot/2.1 (+http://www.googlebot.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:28 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Googlebot/2.1 (+http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:28 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; iaskspider/1.0; MSIE 6.0)＂
143.92.34.18 – – [17/Aug/2024:09:53:29 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:29 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Yahoo! Slurp China; http://misc.yahoo.com.cn/help.html\xA1\xB1)＂
143.92.34.18 – – [17/Aug/2024:09:53:29 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; YodaoBot/1.0; http://www.yodao.com/help/webmaster/spider/\xA1\xB1; )＂
143.92.34.18 – – [17/Aug/2024:09:53:30 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Yahoo! Slurp China; http://misc.yahoo.com.cn/help.html\xA1\xB1)＂
143.92.34.18 – – [17/Aug/2024:09:53:30 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Googlebot/2.1 (+http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:30 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Yahoo! Slurp China; http://misc.yahoo.com.cn/help.html\xA1\xB1)＂
143.92.34.18 – – [17/Aug/2024:09:53:31 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html\xA3\xA9＂
143.92.34.18 – – [17/Aug/2024:09:53:31 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (Linux;u;Android 4.2.2;zh-cn;)＂
143.92.34.18 – – [17/Aug/2024:09:53:31 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Sogou Push Spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07\xA1\xE5)＂
143.92.34.18 – – [17/Aug/2024:09:53:31 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:32 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:32 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Sogou web spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07\xA1\xE5)＂
143.92.34.18 – – [17/Aug/2024:09:53:32 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html\xA3\xA9＂
143.92.34.18 – – [17/Aug/2024:09:53:32 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂AppleWebKit/534.46 (KHTML,like Gecko) Version/5.1 Mobile Safari/10600.6.3＂
143.92.34.18 – – [17/Aug/2024:09:53:33 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Googlebot/2.1 (+http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:33 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂iaskspider/2.0(+http://iask.com/help/help_index.html\xA1\xB1)＂
143.92.34.18 – – [17/Aug/2024:09:53:33 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂AppleWebKit/534.46 (KHTML,like Gecko) Version/5.1 Mobile Safari/10600.6.3＂
143.92.34.18 – – [17/Aug/2024:09:53:33 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂AppleWebKit/534.46 (KHTML,like Gecko) Version/5.1 Mobile Safari/10600.6.3＂
143.92.34.18 – – [17/Aug/2024:09:53:34 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; YodaoBot/1.0; http://www.yodao.com/help/webmaster/spider/\xA1\xB1; )＂
143.92.34.18 – – [17/Aug/2024:09:53:34 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:34 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂iaskspider/2.0(+http://iask.com/help/help_index.html\xA1\xB1)＂
143.92.34.18 – – [17/Aug/2024:09:53:34 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; YodaoBot/1.0; http://www.yodao.com/help/webmaster/spider/\xA1\xB1; )＂
143.92.34.18 – – [17/Aug/2024:09:53:35 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂AppleWebKit/534.46 (KHTML,like Gecko) Version/5.1 Mobile Safari/10600.6.3＂
143.92.34.18 – – [17/Aug/2024:09:53:35 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp\xA1\xB1)＂
143.92.34.18 – – [17/Aug/2024:09:53:35 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂msnbot/1.0 (+http://search.msn.com/msnbot.htm\xA1\xB1)＂
143.92.34.18 – – [17/Aug/2024:09:53:36 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂msnbot/1.0 (+http://search.msn.com/msnbot.htm\xA1\xB1)＂
143.92.34.18 – – [17/Aug/2024:09:53:36 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp\xA1\xB1)＂
143.92.34.18 – – [17/Aug/2024:09:53:36 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; YodaoBot/1.0; http://www.yodao.com/help/webmaster/spider/\xA1\xB1; )＂
143.92.34.18 – – [17/Aug/2024:09:53:36 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; YodaoBot/1.0; http://www.yodao.com/help/webmaster/spider/\xA1\xB1; )＂
143.92.34.18 – – [17/Aug/2024:09:53:37 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp\xA1\xB1)＂
143.92.34.18 – – [17/Aug/2024:09:53:37 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂AppleWebKit/534.46 (KHTML,like Gecko) Version/5.1 Mobile Safari/10600.6.3＂
143.92.34.18 – – [17/Aug/2024:09:53:37 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; YodaoBot/1.0; http://www.yodao.com/help/webmaster/spider/\xA1\xB1; )＂
143.92.34.18 – – [17/Aug/2024:09:53:37 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Sogou Push Spider/3.0(+http://www.sogou.com/docs/help/webmasters.htm#07\xA1\xE5)＂
143.92.34.18 – – [17/Aug/2024:09:53:38 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Googlebot/2.1 (+http://www.googlebot.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:38 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (Linux;u;Android 4.2.2;zh-cn;)＂
143.92.34.18 – – [17/Aug/2024:09:53:38 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:39 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)＂
143.92.34.18 – – [17/Aug/2024:09:53:39 +0800] ＂POST /xmlrpc.php HTTP/1.1＂ 405 415 ＂https://www.itylq.com＂＂Googlebot/2.1 (+http://www.google.com/bot.html)＂