我的VPS发起攻击？这是什么鬼？

happy56188

我之前买了一个月的Olink5刀VPS,结果被人一天把流量干没了，不打算续费也没管他，今天收到邮件说

1. 您好，
   
2. 由于您的vps发起攻击，您的vps已经被临时关闭，请您联系我们解决该问题。
   
3. 
   
4. 12:31:01.529539 IP 31.22.109.10.11909 > 106.119.174.47.80: Flags [R], seq 780495975, win 0, length 0
   
5. 12:31:01.599507 IP 106.119.174.47.80 > 31.22.109.10.17337: Flags [S.], seq 2928893111, ack 1136223237, win 14400, options [mss 1420], length 0
   
6. 12:31:01.599595 IP 31.22.109.10.17337 > 106.119.174.47.80: Flags [R], seq 1136223237, win 0, length 0
   
7. 12:31:01.673657 IP 106.119.174.47.80 > 31.22.109.10.47047: Flags [S.], seq 1471946375, ack 3083273341, win 14400, options [mss 1420], length 0
   
8. 12:31:01.673751 IP 31.22.109.10.47047 > 106.119.174.47.80: Flags [R], seq 3083273341, win 0, length 0
   
9. 12:31:01.675056 IP 106.119.174.47.80 > 31.22.109.10.43597: Flags [S.], seq 3177464767, ack 2857234440, win 14400, options [mss 1420], length 0
   
10. 12:31:01.675127 IP 31.22.109.10.43597 > 106.119.174.47.80: Flags [R], seq 2857234440, win 0, length 0
    
11. 12:31:01.694071 IP 106.119.174.47.80 > 31.22.109.10.47684: Flags [S.], seq 47499497, ack 3125057112, win 14400, options [mss 1420], length 0
    
12. 12:31:01.694156 IP 31.22.109.10.47684 > 106.119.174.47.80: Flags [R], seq 3125057112, win 0, length 0
    
13. 12:31:01.723667 IP 106.119.174.47.80 > 31.22.109.10.52881: Flags [S.], seq 1349916274, ack 3465642855, win 14400, options [mss 1420], length 0
    
14. 12:31:01.723704 IP 106.119.174.47.80 > 31.22.109.10.6054: Flags [S.], seq 3627426820, ack 396819559, win 14400, options [mss 1420], length 0
    
15. 12:31:01.723764 IP 31.22.109.10.52881 > 106.119.174.47.80: Flags [R], seq 3465642855, win 0, length 0
    
16. 12:31:01.723786 IP 31.22.109.10.6054 > 106.119.174.47.80: Flags [R], seq 396819559, win 0, length 0
    
17. 12:31:01.726875 IP 106.119.174.47.80 > 31.22.109.10.62634: Flags [S.], seq 1342435128, ack 4104788785, win 14400, options [mss 1420], length 0
    
18. 12:31:01.726932 IP 31.22.109.10.62634 > 106.119.174.47.80: Flags [R], seq 4104788785, win 0, length 0
    
19. 12:31:01.745114 IP 106.119.174.47.80 > 31.22.109.10.22637: Flags [S.], seq 2919146593, ack 1483557160, win 14400, options [mss 1420], length 0
    
20. 12:31:01.745206 IP 31.22.109.10.22637 > 106.119.174.47.80: Flags [R], seq 1483557160, win 0, length 0
    
21. 12:31:01.765235 IP 106.119.174.47.80 > 31.22.109.10.41780: Flags [S.], seq 2926517560, ack 2738136087, win 14400, options [mss 1420], length 0
    
22. 12:31:01.765319 IP 31.22.109.10.41780 > 106.119.174.47.80: Flags [R], seq 2738136087, win 0, length 0
    
23. 12:31:01.780495 IP 106.119.174.47.80 > 31.22.109.10.55007: Flags [S.], seq 2016879605, ack 3604978755, win 14400, options [mss 1420], length 0
    
24. 12:31:01.780567 IP 31.22.109.10.55007 > 106.119.174.47.80: Flags [R], seq 3604978755, win 0, length 0
    
25. 12:31:01.783532 IP 106.119.174.47.80 > 31.22.109.10.49037: Flags [S.], seq 3748516651, ack 3213692016, win 14400, options [mss 1420], length 0
    
26. 12:31:01.783566 IP 31.22.109.10.49037 > 106.119.174.47.80: Flags [R], seq 3213692016, win 0, length 0
    
27. 12:31:01.785767 IP 106.119.174.47.80 > 31.22.109.10.40291: Flags [S.], seq 700575403, ack 2640547893, win 14400, options [mss 1420], length 0
    
28. 12:31:01.785794 IP 31.22.109.10.40291 > 106.119.174.47.80: Flags [R], seq 2640547893, win 0, length 0

复制代码

大猫熊

可能被入侵中马了噢

kiwix

是弱口令还是用了啥后门的脚本了？

Andrey

中木馬了，這種一般是用戶的問題

KuYeHQ

我也中招过，多半是脚本不干净