老是有一些人攻击市面上常用软件的路由
异常日志格式为
[GIN] 2026/02/11 - 09:06:46 | 200 | 110.464µs | 165.22.216.175 | GET "/"
[GIN] 2026/02/11 - 09:06:52 | 200 | 82.463µs | 165.22.216.175 | GET "/favicon.ico"
[GIN] 2026/02/11 - 09:07:15 | 200 | 59.662µs | 176.65.134.20 | PROPFIND "/"
[GIN] 2026/02/11 - 09:32:31 | 200 | 99.433µs | 161.153.16.161 | GET "/app-center-static/serviceicon/myapp/{0}/?size=../../../../etc/passwd"
[GIN] 2026/02/11 - 09:44:20 | 200 | 92.193µs | 31.192.234.87 | POST "/"
[GIN] 2026/02/11 - 09:44:21 | 200 | 66.632µs | 31.192.234.87 | POST "/index.php"
[GIN] 2026/02/11 - 09:44:21 | 200 | 81.293µs | 31.192.234.87 | POST "/admin"
shell命令是
grep -oE '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' 你的日志文件.log | sort | uniq -c | sort -nr
把攻击ip加入黑名单
iptables -A INPUT -s 31.192.234.87 -j DROP
