服务器被蹂躏了怎么办？

[Saaee]

比较菜，这个是被DDOS的情形么？
应该如何应对？ IP不固定，国内外的都有。
183.69.23.254 - - [02/Oct/2014:18:24:34 +0800] "GET /plugins/ckplayer/ckplayer.swfcO HTTP/1.1" 404 203
183.245.32.79 - - [02/Oct/2014:18:24:34 +0800] "GET /plugins/ckplayer/ckplayer.swfSFCrCN29Nb HTTP/1.1" 404 203
180.103.228.7 - - [02/Oct/2014:18:24:34 +0800] "GET /plugins/ckplayer/ckplayer.swf5LGx97I1UWuwuS2GaSFD HTTP/1.1" 404 203
183.158.42.57 - - [02/Oct/2014:18:24:34 +0800] "GET /plugins/ckplayer/ckplayer.swfwOxvK0yWsjkXWMR HTTP/1.1" 404 203
175.23.6.167 - - [02/Oct/2014:18:24:34 +0800] "GET /plugins/ckplayer/ckplayer.swfcLJEaT0O30O1YfOhRRZ HTTP/1.1" 404 203
1.25.144.50 - - [02/Oct/2014:18:24:34 +0800] "GET /plugins/ckplayer/ckplayer.swf0s50Ex HTTP/1.1" 404 203
60.223.111.100 - - [02/Oct/2014:18:24:34 +0800] "GET /plugins/ckplayer/ckplayer.swf3FWje HTTP/1.1" 404 203
221.231.92.92 - - [02/Oct/2014:18:24:34 +0800] "GET /plugins/ckplayer/ckplayer.swfaaqst0e7hjpVCG HTTP/1.1" 404 203
223.81.197.142 - - [02/Oct/2014:18:24:34 +0800] "GET /plugins/ckplayer/ckplayer.swfFO79QWCOpLGQv HTTP/1.1" 404 203
111.166.107.155 - - [02/Oct/2014:18:24:34 +0800] "GET /plugins/ckplayer/ckplayer.swf6YpAsO8Ft7kwhIURnz6v HTTP/1.1" 404 203
119.139.243.63 - - [02/Oct/2014:18:24:34 +0800] "GET /plugins/ckplayer/ckplayer.swfrT450yVz HTTP/1.1" 404 203
112.228.170.109 - - [02/Oct/2014:18:24:34 +0800] "GET /plugins/ckplayer/ckplayer.swfHaw HTTP/1.1" 404 203
113.81.219.57 - - [02/Oct/2014:18:24:34 +0800] "GET /plugins/ckplayer/ckplayer.swfU2aLuxhtNZ2gFuhI0y5s HTTP/1.1" 404 203
112.237.107.50 - - [02/Oct/2014:18:24:35 +0800] "GET /plugins/ckplayer/ckplayer.swfCeJ0P4MDer20qtGAcW8 HTTP/1.1" 404 203
112.237.107.50 - - [02/Oct/2014:18:24:35 +0800] "GET /plugins/ckplayer/ckplayer.swfBBbxKU747KsahHtZF HTTP/1.1" 404 203
115.231.58.114 - - [02/Oct/2014:18:24:35 +0800] "GET /plugins/ckplayer/ckplayer.swfEfZD6zg HTTP/1.1" 404 203

[wzxjohn]

就这么点IP也能叫DDoS？
目测又是原先机器的主人忘了解除域名绑定神马的。。。

[Saaee]

@wzxjohn 我没贴全部，这是一部分，所有请求都这个类型的，持续一天了。

[66beta]

不太懂网络方便的东西，我在想是不是可以301给baidu？

[hzqim]

@66beta 301到127.0.0.1 结果是指向自己的服务器还是指向攻击者的服务器？

[wzxjohn]

@hzqim 当然是指向访问客户端的本机。。。
@Saaee 应该是我说的原主人忘了改域名绑定。。。

[potaty]

momo

[fatpa]

nginx 可以对每个 ip 进行并发控制，超过就返回 503

[midpoint]

为什么都是“/plugins/ckplayer/ckplayer.swf‘，是这个插件有问题吗？

[jakes]

我之前有遇到扫描的，天天跑满我的CPU，我一口气全BLOCK掉了。