懂的帮忙看这个是不是攻击
昨天的IIS 日志，貌似一直持续了个把小时。这个是攻击吗？
2014-01-14 16:00:00 42.120.6.99 GET /templates/green/phpsso_server/api.php op=install&username=phpcms&password=cfreer&url=123&name=123&authkey=123&apifilename=123&charset=123&type=123&synlogin=123 80 - 110.75.186.226 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; .NET CLR 1.1.4322;Alibaba.Security.Heimdall.{910236}) 404 0 2 218
2014-01-14 16:00:00 42.120.6.99 GET /templates/green/apps/include.php file=/etc/passwd 80 - 110.75.186.226 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; .NET CLR 1.1.4322;Alibaba.Security.Heimdall.{910236}) 404 0 2 203
2014-01-14 16:00:01 42.120.6.99 GET /news/api/uc.php code=fd92NqvC0fvDd3K8T4F9wiNlGHGg+z13GSxyds04jK36mfZacZwYY5bVdHPO0hSTj4Zd4Q7mhGp70q+osC6PYhZZQxKJp3vOR5z5SQ 80 - 110.75.186.226 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; .NET CLR 1.1.4322;Alibaba.Security.Heimdall.{910236}) 404 0 2 203
2014-01-14 16:00:01 42.120.6.99 GET /templates/green/phpsso_server/api.php op=installi1811155216i&username=phpcms&password=cfreer&url=123&name=123&authkey=123&apifilename=123&charset=123&type=123&synlogin=123 80 - 110.75.186.226 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; .NET CLR 1.1.4322;Alibaba.Security.Heimdall.{910236}) 404 0 2 203
2014-01-14 16:00:01 42.120.6.99 GET /templates/green/apps/include.php file=../../../../../../../../etc/passwd 80 - 110.75.186.226 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; .NET CLR 1.1.4322;Alibaba.Security.Heimdall.{910236}) 404 0 2 187
2014-01-14 16:00:01 42.120.6.99 GET /photo/tools/FileNotFound.htm aspxerrorpath=/etc/passwd 80 - 110.75.186.226 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; .NET CLR 1.1.4322;Alibaba.Security.Heimdall.{910236}) 404 0 2 187
2014-01-14 16:00:02 42.120.6.99 GET /templates/green/phpsso_server/api.php op=install&username=phpcms&password=cfreer&url=123&name=123&authkey=123&apifilename=123&charset=123&type=123&synlogin=123 80 - 110.75.186.226 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; .NET CLR 1.1.4322;Alibaba.Security.Heimdall.{910236}) 404 0 2 78
2014-01-14 16:00:02 42.120.6.99 GET /templates/green/apps/include.php file=../../../../../../../../etc/passwd.jpg 80 - 110.75.186.226 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; .NET CLR 1.1.4322;Alibaba.Security.Heimdall.{910236}) 404 0 2 171
2014-01-14 16:52:13 42.120.6.99 GET /scripts/lhgdialog/phpsso_server/api.php op=../../../../../../../../windows/win.ini&username=phpcms&password=cfreer&url=123&name=123&authkey=123&apifilename=123&charset=123&type=123&synlogin=123 80 - 110.75.186.226 Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; Maxthon; .NET CLR 1.1.4322;Alibaba.Security.Heimdall.{910236}) 404 0 2 79
写回答
-
-
-
-
-
Re懂的帮忙看这个是不是攻击貌似不是，ua是阿里安全什么的，你是不是开云盾子之类。
他们防护之前，默认都会扫描一遍常见漏洞，然后，如果有问题会回报给你。
不管用什么程序，总会有一帮人什么漏洞扫描，sql注入之类，习惯就好了，保持官网最新版很重要。2014-01-15 16:05:34赞同 展开评论 打赏
版权声明：本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。
