Received many simulated http requests, looking for a solution.-PHP Tutorial-php.cn

Received many simulated http requests, looking for a solution.

WBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWBOYWB

Release： 2016-07-06 13:52:20

Original

1347 people have browsed it

The server is owned by Alibaba Cloud, and now I am encountering this problem:
When accessing the webpage website.com/test.php, this link is not publicly accessible.
As you can see in the access log, At the same time, there are 3-7 website.com/test.php with the same request,
and the accessed IPs are all different, and the User-Agent is different.
I have changed a few links that have not been used before. This problem will also occur in the test,

It feels like as soon as you visit a page, you will have several simulated visits at the same time, visiting the same page with you.

The following is the log of an access. Only the last IP in it is ours. This is accessed by scanning the QR code with your mobile phone.

101.226.33.208 - - [24/Jun/2016:15:21:27 0800] "GET /test.php?s=123456 HTTP/1.1" 200 25826 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; zh-cn; GT-I9500 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko)Version/4.0 MQQBrowser/5.0 QQ-URL-Manager Mobile Safari/537.36"
112.64.235.86 - - [ 24/Jun/2016:15:21:27 0800] "GET /test.php?s=123456 HTTP/1.1" 200 25825 "-" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36"
223.104.227.207 - - [24/Jun/2016:15:21:28 0800] "GET /test.php?s=123456 HTTP/1.1" 200 25827 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_2 like Mac OS [24/Jun/2016:15:21:35 0800] "GET /test.php?s=123456 HTTP/1.1" 200 25826 "-" "Mozilla/5.0 (Linux; Android 4.4.4; HUAWEI G7-UL20 Build /HuaweiG7-UL20) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/37.0.0.0 Mobile MQQBrowser/6.2 TBS/036523 Safari/537.36 MicroMessenger/6.3.18.800 NetType/3gnet Language/zh_CN"
123.151.152.1 51 - - [24/Jun/2016:15:27:06 0800] "GET /test.php?s=123456 HTTP/1.1" 200 25860 "-" "Mozilla/5.0 (Linux; Android 4.4.2; 2014501 Build/ KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/37.0.0.0 Mobile MQQBrowser/6.2 TBS/036524 Safari/537.36 MicroMessenger/6.3.18.800 NetType/cmnet Language/zh_CN"

Reply content:

The server is owned by Alibaba Cloud, and now I am encountering this problem:

When accessing the webpage website.com/test.php, this link is not publicly accessible.
As you can see in the access log, At the same time, there are 3-7 website.com/test.php with the same request,
and the accessed IPs are all different, and the User-Agent is different.
I have changed a few links that have not been used before. This problem will also occur in the test,

It feels like as soon as you visit a page, you will have several simulated visits at the same time, visiting the same page with you.

The following is the log of an access. Only the last IP in it is ours. This is accessed by scanning the QR code with your mobile phone.

112.64.235.86 - - [ 24/Jun/2016:15:21:27 0800] "GET /test.php?s=123456 HTTP/1.1" 200 25825 "-" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.101 Safari/537.36"
223.104.227.207 - - [24/Jun/2016:15:21:28 0800] "GET /test.php?s=123456 HTTP/1.1" 200 25827 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 9_3_2 like Mac OS [24/Jun/2016:15:21:35 0800] "GET /test.php?s=123456 HTTP/1.1" 200 25826 "-" "Mozilla/5.0 (Linux; Android 4.4.4; HUAWEI G7-UL20 Build /HuaweiG7-UL20) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/37.0.0.0 Mobile MQQBrowser/6.2 TBS/036523 Safari/537.36 MicroMessenger/6.3.18.800 NetType/3gnet Language/zh_CN"
123.151.152.1 51 - - [24/Jun/2016:15:27:06 0800] "GET /test.php?s=123456 HTTP/1.1" 200 25860 "-" "Mozilla/5.0 (Linux; Android 4.4.2; 2014501 Build/ KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/37.0.0.0 Mobile MQQBrowser/6.2 TBS/036524 Safari/537.36 MicroMessenger/6.3.18.800 NetType/cmnet Language/zh_CN"

Please post the detailed log or IP. Did you use any testing tools?

I estimate that Alibaba may have some security tools that are automatically scanning.

It seems to be a security scan by Tencent. If you send the link via QQ, WeChat or email, there will be a request

Are you using 360 Secure Browser like me, and have Tencent’s Computer Manager installed?
There is an unknown request in my background

<code>mozilla/5.0 (linux; u; android 4.4.2; zh-cn; gt-i9500 build/kot49h) applewebkit/537.36 (khtml, like gecko)version/4.0 mqqbrowser/5.0 qq-url-manager mobile safari/537.36</code>

Copy after login

Finally, I searched for qq-url-manager and found this answer from the search engine.