被cc攻击，服务器cpu占有率100%，怎么办？

123跑

大家好

我的vps上有三个站，
只要把file:///C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\%W@GJ$ACOF(TYDYECOKVDYB.pngwww.gaof.cn这个解析给停了，
其他的完全正常，
我把这个域名解析到别的目录，也完全正常，
用别的域名来绑定现在的站点目录，也没问题，
就是不能用file:///C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\%W@GJ$ACOF(TYDYECOKVDYB.pngwww.gaof.cn来绑定我的站点，
只要绑定了，cpu就上涨到100%，
百度加速乐和360监测不到cc攻击，安全狗有检测到，
这是什么问题？
哪位大神给指点下啊

天外飘仙

是网站被黑了，程序异常；还是外部cc攻击 这个你要搞清楚的；

如果用了安全狗，开了 360网站卫士 还不行的话就没办法了，剩下的只能找空间商技术求助了

123跑

找了，他们现在也是束手无措，搞了两天了，还不知道怎么解决呢，

123跑

大家好，查看了iis日志如下情况，随机复制了几段，是cc攻击的特征吗？该如何防范？




#Software: Microsoft HTTP API 1.0
#Version: 1.0
#Date: 2014-07-15 09:24:28
#Fields: date time c-ip c-port s-ip s-port cs-version cs-method cs-uri sc-status s-siteid s-reason s-queuename
2014-07-15 09:24:28 123.125.71.20 7743 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=d9b96ac7&m=_login._qq 400 - Hostname -
2014-07-15 09:24:28 220.181.108.107 53624 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=db765336&m=_login._baidu 400 - Hostname -
2014-07-15 09:24:28 220.181.108.155 65287 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=cdddc3b0&m=_login._baidu 400 - Hostname -
2014-07-15 09:24:28 123.125.71.77 50294 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=0ebd25e9&m=_login._weibo 400 - Hostname -
2014-07-15 09:24:28 123.125.71.90 52875 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=c2de0c72&m=_login._baidu 400 - Hostname -
2014-07-15 09:24:28 123.125.71.90 52876 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=258d31c9&m=_login._qq 400 - Hostname -
2014-07-15 09:24:28 123.125.71.75 50289 10.0.3.233 80 HTTP/1.1 GET /search.php?mod=forum&srchtxt=%BB%EE%B6%AF&formhash=c55baf69&searchsubmit=true&source=hotsearch 400 - Hostname -
2014-07-15 09:24:30 220.181.108.95 13587 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=c67877bd&m=_login._baidu 400 - Hostname -
2014-07-15 09:24:30 220.181.108.117 60384 10.0.3.233 80 HTTP/1.1 GET /house.php?mod=list&op=search&search_txt=%C1%D6%BF%CF%B9%AB%D4%B0&profile_type_id=3&toward=%C4%CF&room=%B6%FE%BC%E4&room= 400 - Hostname -
2014-07-15 09:24:33 123.125.71.23 34625 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=0712fe61&m=_login._qq 400 - Hostname -
2014-07-15 09:24:33 220.181.108.160 51148 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=b61d3b21&m=_login._taobao 400 - Hostname -
2014-07-15 09:24:33 123.125.71.90 52933 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=bfb40597&m=_login._qq 400 - Hostname -
2014-07-15 09:24:33 220.181.108.166 44663 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=c03df9f2&m=_login._qq 400 - Hostname -
2014-07-15 09:24:33 123.125.71.20 7814 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=1505488e&m=_login._qq 400 - Hostname -




2014-07-15 09:24:45 220.181.108.175 30701 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=c919d63d&m=_login._baidu 400 - Hostname -
2014-07-15 09:24:46 123.125.71.57 24728 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=b5d78674&m=_login._taobao 400 - Hostname -
2014-07-15 09:24:46 123.125.71.55 13800 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=c6a8bc50&m=_login._taobao 400 - Hostname -
2014-07-15 09:24:46 123.125.71.22 46464 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=c16cc413&m=_login._qq 400 - Hostname -
2014-07-15 09:24:46 123.125.71.108 64081 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=2205857d&m=_login._baidu 400 - Hostname -
2014-07-15 09:24:46 123.125.71.44 9105 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=c97e3ed3&m=_login._weibo 400 - Hostname -
2014-07-15 09:24:46 123.125.71.17 3786 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=c9382671&m=_login._qq 400 - Hostname -
2014-07-15 09:24:46 123.125.71.96 4470 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=c701931a&m=_login._qq 400 - Hostname -












2014-07-15 09:35:09 123.125.71.97 6994 10.0.3.233 80 HTTP/1.1 GET /house.php?mod=list&profile_type_id=1&room=%B6%FE%BC%E4&house_type=%D7%A1%D5%AC&hall=%CE%E5%BC%E4%D2%D4%C9%CF&toward=%B6%AB%CE%F7&house_type=%B9%AB%D4%A2 400 - Hostname -
2014-07-15 09:35:09 220.181.108.109 8977 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=bce38a32&m=_login._taobao 400 - Hostname -
2014-07-15 09:35:09 123.125.71.21 9355 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=c30f2c7b&m=_login._taobao 400 - Hostname -
2014-07-15 09:35:09 123.125.71.46 35644 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=c16f4650&m=_login._weibo 400 - Hostname -
2014-07-15 09:35:09 123.125.71.115 63905 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=03392620&m=_login._baidu 400 - Hostname -
2014-07-15 09:35:09 123.125.71.26 42741 10.0.3.233 80 HTTP/1.1 GET /plugin.php?id=levquick:l&fh=c64ed2ee&m=_login._weibo 400 - Hostname -





2014-07-15 14:41:35 207.46.13.94 5816 10.0.3.233 80 - - - - - Timer_ConnectionIdle -
2014-07-15 14:41:50 123.125.71.31 17058 10.0.3.233 80 - - - - - Timer_MinBytesPerSecond -
2014-07-15 14:41:58 66.249.67.184 33706 10.0.3.233 80 HTTP/1.1 GET /wap/index.php?moduleid=16&areaid=386 400 - Hostname -
2014-07-15 14:43:08 66.249.67.171 60927 10.0.3.233 80 HTTP/1.1 GET /wap/index.php?moduleid=10&areaid=230 400 - Hostname -
2014-07-15 14:44:23 66.249.67.171 63384 10.0.3.233 80 HTTP/1.1 GET /wap/index.php?moduleid=17&areaid=182 400 - Hostname -
2014-07-15 14:45:04 123.125.71.78 48193 10.0.3.233 80 HTTP/1.1 GET /company/list.php?catid=127 400 - Hostname -
2014-07-15 14:45:04 183.61.34.39 51886 10.0.3.233 80 HTTP/1.1 GET /content/uploadfile/zx/2012121320/淘耳机1213204645手机－ｔａｏｅｊ.jpg 400 - Hostname -
2014-07-15 14:47:15 66.249.67.197 60133 10.0.3.233 80 HTTP/1.1 GET /wap/index.php?moduleid=21&areaid=191 400 - Hostname -







2014-07-15 17:16:47 182.118.20.165 1183 10.0.3.233 80 - - - - - Timer_ConnectionIdle -
2014-07-15 17:16:47 182.118.20.172 55096 10.0.3.233 80 - - - - - Timer_ConnectionIdle -
2014-07-15 17:16:47 182.118.20.172 55097 10.0.3.233 80 - - - - - Timer_ConnectionIdle -
2014-07-15 17:16:47 182.118.20.167 59902 10.0.3.233 80 - - - - - Timer_ConnectionIdle -
2014-07-15 17:17:12 123.125.71.110 35897 10.0.3.233 80 - - - - - Timer_MinBytesPerSecond -
2014-07-15 17:17:17 182.118.20.169 50204 10.0.3.233 80 - - - - - Timer_ConnectionIdle -
2014-07-15 17:17:17 182.118.20.169 50207 10.0.3.233 80 - - - - - Timer_ConnectionIdle -
2014-07-15 17:17:17 182.118.20.162 47076 10.0.3.233 80 - - - - - Timer_ConnectionIdle -
2014-07-15 17:17:17 182.118.20.168 60253 10.0.3.233 80 - - - - - Timer_ConnectionIdle -














2014-07-15 21:16:52 123.125.71.81 27417 10.0.3.233 80 HTTP/1.1 GET /robots.txt 400 - Hostname -
2014-07-15 21:16:57 66.249.67.197 37070 10.0.3.233 80 HTTP/1.1 GET /wap/index.php?moduleid=13&areaid=269 400 - Hostname -
2014-07-15 21:17:06 123.125.71.56 27932 10.0.3.233 80 HTTP/1.1 GET /robots.txt 400 - Hostname -
2014-07-15 21:17:13 123.125.71.104 20896 10.0.3.233 80 HTTP/1.1 GET /robots.txt 400 - Hostname -














2014-07-16 00:17:11 66.249.67.197 43974 10.0.3.233 80 - - - - - Timer_MinBytesPerSecond -
2014-07-16 00:18:54 123.125.68.9 19193 10.0.3.233 80 HTTP/1.1 GET /tt/pic.php?url=http://img3.laibafile.cn/p/m/152488494.jpg 400 - Hostname -
2014-07-16 00:19:33 123.125.71.117 47203 10.0.3.233 80 - - - - - Timer_MinBytesPerSecond -
2014-07-16 00:19:46 66.249.67.171 33614 10.0.3.233 80 HTTP/1.1 GET /tt/article.php?pd=828&id=9773&page=10 400 - Hostname -
2014-07-16 00:20:03 66.249.67.171 33614 10.0.3.233 80 - - - - - Timer_MinBytesPerSecond -
2014-07-16 00:20:18 123.125.71.43 49209 10.0.3.233 80 - - - - - Timer_MinBytesPerSecond -
2014-07-16 00:20:23 220.181.108.187 38143 10.0.3.233 80 - - - - - Timer_MinBytesPerSecond -












2014-07-16 00:31:58 66.249.67.158 46916 10.0.3.233 80 HTTP/1.1 GET /tt/article.php?pd=16&id=841840&page=8 400 - Hostname -
2014-07-16 00:33:26 220.181.108.177 34635 10.0.3.233 80 - - - - - Timer_MinBytesPerSecond -
2014-07-16 00:34:07 218.28.25.50 53614 10.0.3.233 80 - - - - - Timer_ConnectionIdle -
2014-07-16 00:34:07 60.213.2.218 56313 10.0.3.233 80 - - - - - Timer_ConnectionIdle -
2014-07-16 00:34:07 221.202.188.186 52945 10.0.3.233 80 - - - - - Timer_ConnectionIdle -
2014-07-16 00:34:07 116.252.224.162 17304 10.0.3.233 80 - - - - - Timer_ConnectionIdle -
2014-07-16 00:34:37 123.125.71.24 23268 10.0.3.233 80 - - - - - Timer_MinBytesPerSecond -
2014-07-16 00:35:25 66.249.67.197 51313 10.0.3.233 80 HTTP/1.1 GET /wap/index.php?moduleid=21&areaid=124 400 - Hostname -
2014-07-16 00:37:27 220.181.108.86 33127 10.0.3.233 80 - - - - - Timer_MinBytesPerSecond -
2014-07-16 00:37:58 220.181.108.183 37199 10.0.3.233 80 - - - - - Timer_MinBytesPerSecond -
2014-07-16 00:38:13 220.181.108.148 8701 10.0.3.233 80 - - - - - Timer_MinBytesPerSecond -
2014-07-16 00:38:15 66.249.67.197 51906 10.0.3.233 80 HTTP/1.1 GET /wap/index.php?moduleid=17&areaid=119 400 - Hostname -
2014-07-16 00:39:54 123.125.71.102 12498 10.0.3.233 80 - - - - - Timer_MinBytesPerSecond -
2014-07-16 00:42:09 220.181.108.178 28000 10.0.3.233 80 - - - - - Timer_MinBytesPerSecond -

123跑

补充一下：

用的息壤的vps，
里面有三个站点，其他两个现在关了，其实原先也没怎么用，就这一个了www.gaof.cn，现在是cpu到100%
该站点停止绑定www.gaof.cn以后，服务器的cpu就正常了，再次绑定，cpu马上就又100%了，
百度加速乐和360加速都尝试过了，没有效果，没有检测到cc攻击，但是安全狗倒是检测到了有cc攻击，不多，
后来我就把站点和域名对调一下，也就是把这个域名gaof.cn和另一个域名分别绑定在对方的网站目录，也都能打开，
这时候cpu恢复正常了，大概是百分之几到十几，算是正常，
但是只要把www.gaof.cn和这个站点绑到一起就cpu100%
这是什么情况，怎么处理呢？

花满楼

流量很大么？

123跑

花满楼 发表于 2014-7-16 10:48
流量很大么？

不大，没有流量，就是cpu占完了100%，远程登陆服务器也卡，有时候打不开网站，有时候刷新好几次才能打开，没法正常使用，

花满楼

123跑 发表于 2014-7-16 10:58
不大，没有流量，就是cpu占完了100%，远程登陆服务器也卡，有时候打不开网站，有时候刷新好几次才能打开 ...

那进程占用问题吧   你检查下PHP 进程看下占用多少

wxhdayan

这问题研究不透

xandy5004

是不是程序问题