网站日志总是出现'HTTP_HOST': 'www.shadowserver.org', (hidden keys: 22)} failed with Type

时间:2023年09月10日

/

来源:网络

/

编辑:佚名

网站日志经常出现一个域名www.shadowserver.org恶意扫描工具的日志如下:
2023-09-07T06:01:42Z {'REMOTE_ADDR': '64.62.197.50', 'REMOTE_PORT': '41087', 'HTTP_HOST': 'www.shadowserver.org', (hidden keys: 22)} failed with TypeError
<gevent._socket3.socket at 0x7f16d1bf4980 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: "\x16\x03\x01\x00Ê\x01\x00\x00Æ\x03\x03Àn\x06B\x8c,M\x85¿4\x11\x1f©óÈ6`¸¶\x85eo\x93¨F\x92|\x9fË\x11LO\x00\x00hÌ\x14Ì\x13À/À+À0À,À\x11À\x07À'À#À\x13À\tÀ(À$À\x14À\n"
<gevent._socket3.socket at 0x7f16d1bf4980 object, fd=11, family=2, type=1, proto=0>: Expected GET method: 'Z¥\x01 \x00\x00\x00\x00'
<gevent._socket3.socket at 0x7f16d1aac590 object, fd=11, family=2, type=1, proto=0>: Expected GET method: '\x03\x00\x00/*à\x00\x00\x00\x00\x00Cookie: mstshash=Administr\r\n'
<gevent._socket3.socket at 0x7f16d1aacc20 object, fd=13, family=2, type=1, proto=0>: Invalid HTTP method: '\x16\x03\x01\x00î\x01\x00\x00ê\x03\x03\xadè\x18\x9eF9Ì\x0fe\x98DÏj\r\x94\x0fQµEg,Ø\x9b\x06g\x1f⧮³aK \x06TÔ\x18ä\x83¢à<\x99 \x08ðbÚU§]bjØ:&ª\x0c²!\x1fÌ\x80\x1fõ\x00&̨̩À/À0À+À,À\x13À\tÀ\x14À\n'
<gevent._socket3.socket at 0x7f16d1aac590 object, fd=11, family=2, type=1, proto=0>: Expected GET method: '\x03\x00\x00/*à\x00\x00\x00\x00\x00Cookie: mstshash=Administr\r\n'
<gevent._socket3.socket at 0x7f16d1a7ef30 object, fd=11, family=2, type=1, proto=0>: Expected GET method: '\x03\x00\x00/*à\x00\x00\x00\x00\x00Cookie: mstshash=Administr\r\n'
<gevent._socket3.socket at 0x7f16d1a7ef30 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: '\x03\x00\x00\x13\x0eà\x00\x00\x00\x00\x00\x01\x00\x08\x00\x03\x00\x00\x00'
<gevent._socket3.socket at 0x7f16d1a7e520 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: '\x16\x03\x01\x00î\x01\x00\x00ê\x03\x03´ÐÄ\r\x0fò}2e\x93ªµÐP\x92íë°®\x1aÙªã\x922\x83²ÒIn\x90¹ SP~\x85¤\x1br\x88\x8f\x8b3\n'
<gevent._socket3.socket at 0x7f16d1a7e520 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: 'MGLNDD_39.125.157.59_8888\n'
<gevent._socket3.socket at 0x7f16d1a7e520 object, fd=11, family=2, type=1, proto=0>: Expected GET method: '\x03\x00\x00/*à\x00\x00\x00\x00\x00Cookie: mstshash=Administr\r\n'
<gevent._socket3.socket at 0x7f16d1a7e520 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: "\x16\x03\x03\x01\x02\x01\x00\x00þ\x03\x03Ï0. ñ7Di¹\x8c\x85Î-\tµ\x07ºW·\x1b\x15\x84\x9b\x13g+h¶Ç.\x8d2\x00\x00VÀ,À+À0À/\x00\x9f\x00£\x00\x9e\x00¢À$À(À#À'\x00k\x00j\x00g\x00@À.À2À-À1À&À*À%À)À\n"
<gevent._socket3.socket at 0x7f16d1a8b600 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: '\x16\x03\x01\x00î\x01\x00\x00ê\x03\x03|Æ0°¦&\x98g\x8cR\x93\x93#\x83\x0f\x80j¿.zïpáì$µ°0u¢X\x0f 2VUr1°\x05à\x84?FFPøyV?5Ó\x87t\x1eº\\ò$MamØ\x0f\r\x00&À+À/À,À0̨̩À\tÀ\x13À\n'
<gevent._socket3.socket at 0x7f16d1a7e750 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: "\x16\x03\x03\x01\x02\x01\x00\x00þ\x03\x03\x0cò\x88ý\x02\x1dØ\x98\x12+ýѤoµ\x8f\x8aijÚl\x87B\x03MU\x85Ò7\x10s\x92\x00\x00VÀ,À+À0À/\x00\x9f\x00£\x00\x9e\x00¢À$À(À#À'\x00k\x00j\x00g\x00@À.À2À-À1À&À*À%À)À\n"
<gevent._socket3.socket at 0x7f16d3fec130 object, fd=11, family=2, type=1, proto=0>: Expected GET method: "\x16\x03\x01\x00Ê\x01\x00\x00Æ\x03\x03«¦Â]\x81N»ºZ\x92YÆÛlÏíÓâûO5eMV÷°*C\x10\x98Õ7\x00\x00hÌ\x14Ì\x13À/À+À0À,À\x11À\x07À'À#À\x13À\tÀ(À$À\x14À\n"
<gevent._socket3.socket at 0x7f16d3fec130 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: '\x16\x03\x01\x00î\x01\x00\x00ê\x03\x03;mÞ\x9fè¹\x89\n'
<gevent._socket3.socket at 0x7f16d3fec130 object, fd=11, family=2, type=1, proto=0>: Invalid http version: 'PRI * HTTP/2.0\r\n'
<gevent._socket3.socket at 0x7f16d3fecfa0 object, fd=11, family=2, type=1, proto=0>: Expected GET method: 'Z¥\x01 \x00\x00\x00\x00'
<gevent._socket3.socket at 0x7f16d3fecfa0 object, fd=11, family=2, type=1, proto=0>: Expected GET method: '\x03\x00\x00/*à\x00\x00\x00\x00\x00Cookie: mstshash=Administr\r\n'
<gevent._socket3.socket at 0x7f16d1a81d00 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: "\x16\x03\x03\x01\x1a\x01\x00\x01\x16\x03\x03«\x14Î'XYÙĹ·î`f\x02ºðüÇØþÏáF\x94?Ž\x18CÆVº\x00\x00VÀ,À+À0À/\x00\x9f\x00£\x00\x9e\x00¢À$À(À#À'\x00k\x00j\x00g\x00@À.À2À-À1À&À*À%À)À\n"
<gevent._socket3.socket at 0x7f16d1a81d00 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: "\x16\x03\x03\x01\x1a\x01\x00\x01\x16\x03\x03fS\x88ä\x02\x818R\x02\x86\x1a@\x14\x8fZÃe4x\x02qéY\x06%µ^á\x00\x90bF\x00\x00VÀ,À+À0À/\x00\x9f\x00£\x00\x9e\x00¢À$À(À#À'\x00k\x00j\x00g\x00@À.À2À-À1À&À*À%À)À\n"
<gevent._socket3.socket at 0x7f16d1a81d00 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: '\x03\x00\x00\x13\x0eà\x00\x00\x00\x00\x00\x01\x00\x08\x00\x02\x00\x00\x00'
<gevent._socket3.socket at 0x7f16d1a81d00 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: '\x16\x03\x01\x00{\x01\x00\x00w\x03\x03¤Ú6ò[\x08Û\\\x03jÊI¶\xa0á\x0bî\x05WÝ}$\x80\x1b\x85PtÅYF-ç\x00\x00\x1aÀ/À+À\x11À\x07À\x13À\tÀ\x14À\n'
<gevent._socket3.socket at 0x7f16d1a81d00 object, fd=11, family=2, type=1, proto=0>: Invalid http version: '\x16\x03\x01\x00{\x01\x00\x00w\x03\x03ºr/µG\x97ÆÎå\x1bâ-\x7f\x13Ç\x93\x0eóã\x9eF\t¦N¼¡çS\x9aî\x96§\x00\x00\x1aÀ/À+À\x11À\x07À\x13À\tÀ\x14À\n'
[2023-09-08 13:57:46,608][ERROR] - Exception on /www.shadowserver.org:443 [CONNECT]
Traceback (most recent call last):
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/flask/app.py", line 2077, in wsgi_app
    response = self.full_dispatch_request()
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/flask/app.py", line 1526, in full_dispatch_request
    return self.finalize_request(rv)
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/flask/app.py", line 1545, in finalize_request
    response = self.make_response(rv)
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/flask/app.py", line 1702, in make_response
    f"The view function for {request.endpoint!r} did not"
TypeError: The view function for None did not return a valid response. The function either returned None or ended without a return statement.
Traceback (most recent call last):
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/flask/app.py", line 2077, in wsgi_app
    response = self.full_dispatch_request()
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/flask/app.py", line 1526, in full_dispatch_request
    return self.finalize_request(rv)
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/flask/app.py", line 1545, in finalize_request
    response = self.make_response(rv)
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/flask/app.py", line 1702, in make_response
    f"The view function for {request.endpoint!r} did not"
TypeError: The view function for None did not return a valid response. The function either returned None or ended without a return statement.

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/gevent/pywsgi.py", line 999, in handle_one_response
    self.run_application()
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/gevent/pywsgi.py", line 945, in run_application
    self.result = self.application(self.environ, self.start_response)
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/flask/app.py", line 2095, in __call__
    return self.wsgi_app(environ, start_response)
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/flask/app.py", line 2080, in wsgi_app
    response = self.handle_exception(e)
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/flask/app.py", line 1440, in handle_exception
    return self.finalize_request(server_error, from_error_handler=True)
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/flask/app.py", line 1545, in finalize_request
    response = self.make_response(rv)
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/flask/app.py", line 1702, in make_response
    f"The view function for {request.endpoint!r} did not"
TypeError: The view function for None did not return a valid response. The function either returned None or ended without a return statement.
2023-09-08T05:57:46Z {'REMOTE_ADDR': '65.49.1.120', 'REMOTE_PORT': '9007', 'HTTP_HOST': 'www.shadowserver.org', (hidden keys: 22)} failed with TypeError

<gevent._socket3.socket at 0x7f16d3fec8a0 object, fd=11, family=2, type=1, proto=0>: Expected GET method: '\x16\x03\x01\x01X\x01\x00\x01T\x03\x03\x98z\x81¦Âz\x18Å?!\x18îÈ\x17p×Ö°t\x1aÆ\x908\x06ÏãåÂcuæh \x96åÎc©Ñg«þ\x9bÔÜá\x95¹X\x7f«\x14è\x14r½j"\'çòÇÅ\x18(\x00v\x13\x02\x13\x03\x13\x01À/À+À0À,\x00\x9eÀ\'\x00gÀ(\x00k\x00£\x00\x9f̨̩̪À¯À\xadÀ£À\x9fÀ]ÀaÀWÀS\x00¢À®À¬À¢À\x9eÀ\\À`ÀVÀRÀ$\x00jÀ#\x00@À\n'
<gevent._socket3.socket at 0x7f16d3fec8a0 object, fd=11, family=2, type=1, proto=0>: Expected GET method: "\x16\x03\x01\x00Ê\x01\x00\x00Æ\x03\x03\x87!.\x11\x93ä\x13r\x9f«ôΨ{U.PÜ\x7fÎ@°Ó\x81v'Ó,B\x18s\x00\x00hÌ\x14Ì\x13À/À+À0À,À\x11À\x07À'À#À\x13À\tÀ(À$À\x14À\n"
<gevent._socket3.socket at 0x7f16d3fec8a0 object, fd=11, family=2, type=1, proto=0>: Invalid http version: "\x16\x03\x03\x01¦\x01\x00\x01¢\x03\x03ÂÕi?A(\x15\xadø}\x8c¯B\x9eî\x15¦í!¸\x8a\x9c\x1a)eÁ]\x02\x8e_'( \x18ö,QJgª4\x04mñ\xadTí\x10\x02S\x9aÐÇQiâQ>7¶Q\x8döV\x00\x8a\x00\x16\x003\x00gÀ\x9eÀ¢\x00\x9e\x009\x00kÀ\x9fÀ£\x00\x9f\x00E\x00¾\x00\x88\x00Ä\x00\x9aÀ\x08À\tÀ#À¬À®À+À\n"
<gevent._socket3.socket at 0x7f16d3fec8a0 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: '\x16\x03\x03\x01¦\x01\x00\x01¢\x03\x03Î\x95qVìjûæ§Ú\x92U±Î\\^SÂæ~7\xa0àNxp\\\x83¨fq ¹_gðäl\rD5\x8fü\x83èV±Hg\x0bØ\x1d\x99\x93\x8có\x03Ì>\r»§¢!\x00\x8a\x00\x05\x00\x04\x00\x07\x00À\x00\x84\x00º\x00A\x00\x9dÀ¡À\x9d\x00=\x005\x00\x9cÀ\xa0À\x9c\x00<\x00/\x00\n'
<gevent._socket3.socket at 0x7f16d3fec8a0 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: '\x16\x03\x03\x01W\x01\x00\x01S\x03\x03läýè7Æ$|g\n'
<gevent._socket3.socket at 0x7f16d3fec8a0 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: '\x16\x03\x03\x01I\x01\x00\x01E\x03\x03Ù\x8d\x90\x06H&¸jºÐû\x92\x82¯\x1ewo4Á8ÚPî-@\x9a3Ö«Së\x05 0Ý\x9e>nGF"\x9d:\x9bÅ8\x81qì\x82\x1aå\x0f\x0c\x80îL\x10\n'
<gevent._socket3.socket at 0x7f16d3fec8a0 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: "\x16\x03\x03\x01\x9a\x01\x00\x01\x96\x03\x03MÛ\x1e\x90\x0f\x90\x8bf\x08\x12\x9e\x05D\x88¯\x16F=ÍÜ\x02âiF\xa0úÓuÖª\x88( YÊ\x83ÿº{õhj\x1f0\x99\x10Ê-ØHfIX6S2ú+\x80¯\x96õeÆÃ\x00\x8cªªÀ\x12À\x13À\x07À'Ì\x14À/\x13\x01À\x14\x13\x02À(Ì©À0ÀsÀ`ÀrÀaÀ,ÀvÀ¯ÀwÀ\xad̨À$\x13\x05À\n"
<gevent._socket3.socket at 0x7f16d3fec8a0 object, fd=11, family=2, type=1, proto=0>: Invalid http version: '\x16\x03\x02\x01\x9b\x01\x00\x01\x97\x03\x02=ÀòÅ\x04ÿ¸Ê\x89ªî¸&öâ\x9d\x80áOVi"µ37Àpp¾%>} ÏX«>_|\x11W8a\xa0S\x02èQ&rlÏC\n'
<gevent._socket3.socket at 0x7f16d3fec8a0 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: '\x16\x03\x01\x01¨\x01\x00\x01¤\x03\x03*Ì\x9aµ\x8c\x82ôüÂ\x86ç6ur-Q¬\x08|ë¢\x9e@\x85Þ\x85\x91ÅÒ\r\x12\x92 Xk\rTÅr--\x08l$f\t\x06Ò¨\x97þ\x90´\x1f*Ñ-$î\x08\x00/ü¨Î\x00\x8a\x00\x16\x003\x00gÀ\x9eÀ¢\x00\x9e\x009\x00kÀ\x9fÀ£\x00\x9f\x00E\x00¾\x00\x88\x00Ä\x00\x9aÀ\x08À\tÀ#À¬À®À+À\n'
<gevent._socket3.socket at 0x7f16d3fec8a0 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: '\x16\x03\x01\x01¨\x01\x00\x01¤\x03\x031\x1f\x81\x9cÁÃQÚ\x90òOª½×Ç8\x06I~Pû\x16eM\t+0M\t\x05y³ øj;æÅX\x0f\x1a]CóÌ=ó\x07në[Ö>Ë\x03\x86ë\x98¦±z%\x8bè\x13\x00\x8a\x00\x05\x00\x04\x00\x07\x00À\x00\x84\x00º\x00A\x00\x9dÀ¡À\x9d\x00=\x005\x00\x9cÀ\xa0À\x9c\x00<\x00/\x00\n'
<gevent._socket3.socket at 0x7f16d3fec8a0 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: '\x16\x03\x01\x01\x9e\x01\x00\x01\x9a\x03\x03è\rI(~·Êh©Â¶\x0b\x0c Ü\x87¸\\>CUùµ»ßû\x13SL\rLþ &v®¹\x97V±\x1bëc\x8eY\x18i¤)®RÓ~bx<¦©uaèÏé;à\x00\x80\x00\x16\x003\x00gÀ\x9eÀ¢\x00\x9e\x009\x00kÀ\x9fÀ£\x00\x9f\x00E\x00¾\x00\x88\x00Ä\x00\x9aÀ\x08À\tÀ#À¬À®À+À\n'
<gevent._socket3.socket at 0x7f16d3fec8a0 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: "\x16\x03\x01\x01µ\x01\x00\x01±\x03\x03ðígã6BÑ,o\x08ï[\x89°\r¾|(Éx3ȯ-5Sy±ø{ ì ^\x85Qêê\x05\x08\xa0÷\x8f\x10c)\x9c\x9e\x11æÇÛ\x8be>^1\xadãÅLÄû\x18\x02\x00\x8cjjÀ\x12À\x13À\x07À'Ì\x14À/\x13\x01À\x14\x13\x02À(Ì©À0ÀsÀ`ÀrÀaÀ,ÀvÀ¯ÀwÀ\xad̨À$\x13\x05À\n"
<gevent._socket3.socket at 0x7f16d14ef440 object, fd=11, family=2, type=1, proto=0>: Expected GET method: '\x03\x00\x00/*à\x00\x00\x00\x00\x00Cookie: mstshash=Administr\r\n'
<gevent._socket3.socket at 0x7f16d14ef440 object, fd=11, family=2, type=1, proto=0>: Invalid HTTP method: '\x03\x00\x00\x13\x0eà\x00\x00\x00\x00\x00\x01\x00\x08\x00\x02\x00\x00\x00'
Traceback (most recent call last):
  File "src/gevent/greenlet.py", line 906, in gevent._gevent_cgreenlet.Greenlet.run
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/gevent/baseserver.py", line 34, in _handle_and_close_when_done
    return handle(*args_tuple)
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/gevent/pywsgi.py", line 1577, in handle
    handler.handle()
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/gevent/pywsgi.py", line 471, in handle
    self.socket.sendall(response_body)
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/gevent/_socketcommon.py", line 699, in sendall
    return _sendall(self, data_memory, flags)
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/gevent/_socketcommon.py", line 409, in _sendall
    timeleft = __send_chunk(socket, chunk, flags, timeleft, end)
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/gevent/_socketcommon.py", line 338, in __send_chunk
    data_sent += socket.send(chunk, flags)
  File "/www/server/panel/pyenv/lib/python3.7/site-packages/gevent/_socketcommon.py", line 722, in send
    return self._sock.send(data, flags)
BrokenPipeError: [Errno 32] Broken pipe
2023-09-08T12:23:31Z <Greenlet at 0x7f16d40124d0: _handle_and_close_when_done(<bound method WSGIServer.handle of <WSGIServer at , <bound method StreamServer.do_close of <WSGIServer, (<gevent._socket3.socket [closed] at 0x7f16d14ef44)> failed with BrokenPipeError
服务器日志大量出现MGLNDD消息头扫描如何应对?
网站日志总是出现'HTTP_HOST': 'www.shadowserver.org', (hidden keys: 22)} failed with TypeError如何解决?
解决方法如下:
第一步:网站屏蔽来路为www.shadowserver.org的访问
1、打开对应的nginx配置文件,在server下增加如下配置:
if ($http_referer ~* .*.shadowserver.org){
return 404;
}
2、nginx禁止一些空请求
if ( $request_method !~ ^(GET|POST|HEAD)$ ) {
return 400;
}
第二步:防火墙屏蔽shadowserver.org的一些ip,前提条件是ip数量较少。
第三步:增加系统的安全
1、禁止root登陆,设置证书登陆或者禁止22端口登陆。
2、如果用的是宝塔面板,增加面板的安全性,具体操作去宝塔网站了解。
比如说宝塔面板的端口888,8888,宝塔面板安全登陆方式,允许某个ip访问宝塔,或者证书登陆,禁止root登陆,禁用22端口,数据库访问方式是本地而不是远程,安装防火墙等操作。

 
猜你需要

豫ICP备2021026617号-1  豫公网安备:41172602000185   Copyright © 2021-2028 www.78moban.com/ All Rights Reserved

本站作品均来自互联网,转载目的在于传递更多信息,并不代表本站赞同其观点和对其真实性负责。如有侵犯您的版权,请联系 1565229909#qq.com(把#改成@),我们将立即处理。