2. NodeSeek
  3. 看了下nginx日志，还有人正在扫哪吒漏洞

看了下nginx日志，还有人正在扫哪吒漏洞

X1721 2026-06-16 17:26 1

User-Agent是Nezha-GHSA-5c25-7vpj-9mqh-Checker 赶紧先卸载或者关闭服务再说




/var/log/nginx/access.log:2602:ffe4:8:5287:a25b:4451:27b2:31f8 - - [16/Jun/2026:14:42:45 +0800] "GET /dashboard../data/config.yaml HTTP/2.0" 404 1938 "-" "Nezha-GHSA-5c25-7vpj-9mqh-Checker/1.0"

/var/log/nginx/access.log:2602:ffe4:8:5287:a25b:4451:27b2:31f8 - - [16/Jun/2026:14:42:46 +0800] "GET /dashboard../data/config.yaml HTTP/2.0" 404 1938 "-" "Nezha-GHSA-5c25-7vpj-9mqh-Checker/1.0"

/var/log/nginx/access.log:2602:ffe4:8:5287:a25b:4451:27b2:31f8 - - [16/Jun/2026:14:42:47 +0800] "GET /dashboard..%2Fdata/config.yaml HTTP/2.0" 404 1938 "-" "Nezha-GHSA-5c25-7vpj-9mqh-Checker/1.0"
最新回复 (9)
  • lehuoyisheng 06-16 17:32
    1楼

    用的caddy

  • leji 06-16 17:34
    2楼 
    122.10.198.233 - - [16/Jun/2026:14:25:18 +0800] "GET /dashboard../data/config.yaml HTTP/1.1" 404 1890 "-" "Nezha-GHSA-5c25-7vpj-9mqh-Checker/1.0" "-"
    
122.10.198.233 - - [16/Jun/2026:14:25:19 +0800] "GET /dashboard../data/config.yaml HTTP/1.1" 404 1890 "-" "Nezha-GHSA-5c25-7vpj-9mqh-Checker/1.0" "-"
    
122.10.198.233 - - [16/Jun/2026:14:25:19 +0800] "GET /dashboard..%2Fdata/config.yaml HTTP/1.1" 404 1890 "-" "Nezha-GHSA-5c25-7vpj-9mqh-Checker/1.0" "-"
    
122.10.198.233 - - [16/Jun/2026:14:35:24 +0800] "GET /dashboard../data/config.yaml HTTP/1.1" 404 1890 "-" "Nezha-GHSA-5c25-7vpj-9mqh-Checker/1.0" "-"
    
122.10.198.233 - - [16/Jun/2026:14:35:24 +0800] "GET /dashboard../data/config.yaml HTTP/1.1" 404 1890 "-" "Nezha-GHSA-5c25-7vpj-9mqh-Checker/1.0" "-"
    
122.10.198.233 - - [16/Jun/2026:14:35:25 +0800] "GET /dashboard..%2Fdata/config.yaml HTTP/1.1" 404 1890 "-" "Nezha-GHSA-5c25-7vpj-9mqh-Checker/1.0" "-"
    

    
157.119.102.27 - - [16/Jun/2026:12:54:22 +0800] "GET /dashboard../data/config.yaml HTTP/1.1" 404 1890 "-" "Go-http-client/1.1" "-"

    都是今天扫的，11号就更新了

  • coldsword 06-16 17:58
    3楼

    这个命名有可能是🦞搓的脚本

  • MoeXia 06-16 18:06
    4楼

    @X1721 #0 甚至不伪装一下ua，明扫 ^-^

  • Marco919 06-16 18:06
    5楼

    我昨晚都更新了 今天下午1点多给插得agent 所以更新有何用？

  • X1721 楼主 06-16 18:11
    6楼

    @Marco919 #5 还是卸载保平安

  • X1721 楼主 06-16 18:12
    7楼

    @MoeXia #4 可能比较急 ^-^

  • bncfbb 06-16 19:25
    8楼

    我这有伪装UA的，有python requests默认UA的，有摊牌了不装的NezhaCheck/1.0 ^-^


    [15/Jun/2026:18:10:09 +0800] - 502 502 - GET "/dashboard../data/config.yaml" [Client 114.242.3.63] [Length 154] [Gzip -] [Sent-to 127.0.0.1] "Mozilla/5.0 (compatible; NezhaCheck/1.0)" "-"
    
[15/Jun/2026:18:10:10 +0800] - - 301 - GET "/dashboard../data/config.yaml" [Client 114.242.3.63] [Length 166] [Gzip -] [Sent-to 127.0.0.1] "Mozilla/5.0 (compatible; NezhaCheck/1.0)" "-"
    
[15/Jun/2026:18:10:10 +0800] - 502 502 - GET "/dashboard../data/config.yaml" [Client 114.242.3.63] [Length 154] [Gzip -] [Sent-to 127.0.0.1] "Mozilla/5.0 (compatible; NezhaCheck/1.0)" "-"
    
[15/Jun/2026:20:48:30 +0800] - 502 502 - GET "/dashboard../data/config.yaml" [Client 212.87.194.242] [Length 154] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"
    
[15/Jun/2026:20:48:31 +0800] - 502 502 - GET "/dashboard../data/config.yaml" [Client 212.87.194.242] [Length 154] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"
    
[15/Jun/2026:20:48:31 +0800] - 502 502 - GET "/dashboard..%2Fdata/config.yaml" [Client 212.87.194.242] [Length 154] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"
    
[15/Jun/2026:21:22:21 +0800] - 502 502 - GET "/api/v1/server" [Client 67.159.48.147] [Length 154] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"
    
[16/Jun/2026:02:46:40 +0800] - 502 502 - GET "/api/v1/setting" [Client 77.247.127.114] [Length 556] [Gzip -] [Sent-to 127.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36" "-"
    
[16/Jun/2026:02:46:41 +0800] - 502 502 - GET "/dashboard../data/config.yaml" [Client 77.247.127.114] [Length 556] [Gzip -] [Sent-to 127.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36" "-"
    
[16/Jun/2026:02:46:41 +0800] - 502 502 - GET "/dashboard../data/config.yaml" [Client 77.247.127.114] [Length 556] [Gzip -] [Sent-to 127.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36" "-"
    
[16/Jun/2026:02:48:54 +0800] - 502 502 - GET "/api/v1/server" [Client 67.159.48.147] [Length 154] [Gzip -] [Sent-to 127.0.0.1] "python-requests/2.34.2" "-"
    
[16/Jun/2026:15:08:16 +0800] - 502 502 - GET "/dashboard../data/config.yaml" [Client 165.154.255.124] [Length 556] [Gzip -] [Sent-to 127.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" "-"
    
[16/Jun/2026:15:08:31 +0800] - - 301 - GET "/dashboard../data/config.yaml" [Client 165.154.255.124] [Length 166] [Gzip -] [Sent-to 127.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" "-"
    
[16/Jun/2026:15:08:32 +0800] - 502 502 - GET "/dashboard../data/config.yaml" [Client 165.154.255.124] [Length 556] [Gzip -] [Sent-to 127.0.0.1] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36" "-"
  • jake 06-16 19:36
    9楼

    有点夸张

* 帖子来源NodeSeek
附近帖子
返回
飞读
随机推荐