新买的服务器刚配置的/api 路径被疯狂 GET POST，是在找后门吗

[wooody]

新买的阿里云服务器，开了一个/api 路径指向本地端口 8008 的服务，没给任何人说，结果发现这些乱七八糟的访问日志（只列举了一小部分），这是在找我的服务器后门吗？

[26/Nov/2024 10:56:41] "GET /rt/jobs HTTP/1.0" 404 -
[26/Nov/2024 10:56:44] "GET /sprint/getAllProcess HTTP/1.0" 404 -
[26/Nov/2024 10:56:47] "GET /index.html HTTP/1.0" 404 -
[26/Nov/2024 10:56:47] "GET /overview HTTP/1.0" 404 -
[26/Nov/2024 10:56:49] "GET /console/proxy HTTP/1.0" 404 -
[26/Nov/2024 10:56:54] "GET /hbase/idcs HTTP/1.0" 404 -
[26/Nov/2024 10:56:55] "GET /order/getOrderType HTTP/1.0" 404 -
[26/Nov/2024 10:57:02] "GET /v1/login/status HTTP/1.0" 404 -
[26/Nov/2024 10:57:02] "GET /appConfig.json HTTP/1.0" 404 -
[26/Nov/2024 10:57:03] "GET /dashboards/home HTTP/1.0" 404 -
[26/Nov/2024 10:57:04] "GET /search HTTP/1.0" 404 -
[26/Nov/2024 10:57:34] "GET / HTTP/1.0" 200 -
[26/Nov/2024 10:57:35] "POST / HTTP/1.0" 405 -
[26/Nov/2024 10:58:04] "GET /geojson?url=file:////etc/rpc HTTP/1.0" 404 -
[26/Nov/2024 17:38:46] "GET /settings/public HTTP/1.0" 404 -
[26/Nov/2024 17:38:46] "GET /v1/serve HTTP/1.0" 404 -
[27/Nov/2024 09:51:39] "GET /settings/public HTTP/1.0" 404 -
[27/Nov/2024 09:51:39] "GET /v1beta1/getcluster?api_version=v1beta1&obregion_name= HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /v1/debug/pprof/goroutine?debug=1 HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /v1/debug/pprof/trace HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /manyou/cloud_channel.htm HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /v1/info HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /v1/ HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /vabcd HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /config.json HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /v1/targets HTTP/1.0" 404 -
[27/Nov/2024 09:51:40] "GET /v1/serve HTTP/1.0" 404 -
[27/Nov/2024 09:51:41] "GET /systeminfo HTTP/1.0" 404 -
[27/Nov/2024 09:51:42] "GET /docs/ HTTP/1.0" 404 -
[27/Nov/2024 09:51:42] "GET /-docs/ HTTP/1.0" 404 -
[27/Nov/2024 09:51:42] "GET /v1/milvus/connect HTTP/1.0" 404 -
[27/Nov/2024 09:51:42] "GET /agent.html HTTP/1.0" 404 -
[27/Nov/2024 09:51:42] "GET /settings HTTP/1.0" 404 -
[27/Nov/2024 09:51:42] "GET /settings/values HTTP/1.0" 404 -
[27/Nov/2024 09:51:42] "GET /workflows HTTP/1.0" 404 -

[IDAEngine]

证明以前部署过这些服务

[sunny352787]

是的，就是在扫，非常烦

[Devifish]

大多数请求看着像业务的， 部分是扫端口漏洞的。 应该是这 ip 上任机主的其他服务没改配置

[yinmin]

如果仅做 api 服务，可以关闭 http ，只开 https ，然后关闭 https 无 sni 访问，然后就消停了

[MrYELiex]

习惯就好 随便他扫呗 又不会有什么问题 自己代码写健壮就好了 要来扫拦不住的

[Miranquil]

不一定是在扫，换个端口试试。如果立即没有记录了那可能只是现有服务没更新服务端地址。