如何从众多访问IP中，识别出漏洞扫描，恶意攻击的IP，从而将黑客揪出来封禁屏蔽？

        首先，查找web服务器访问日志中包含有返回代码：HTTP/1.1" 403和HTTP/1.1" 404：，如下所示：

34.174.217.120 - - [05/Mar/2023:10:49:18 +0800] "GET //wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:19 +0800] "GET //xmlrpc.php?rsd HTTP/1.1" 404 1432 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:19 +0800] "GET / HTTP/1.1" 200 28091 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:19 +0800] "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:20 +0800] "GET //web/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:20 +0800] "GET //wordpress/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:20 +0800] "GET //website/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:20 +0800] "GET //wp/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:20 +0800] "GET //news/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:21 +0800] "GET //2018/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:21 +0800] "GET //2019/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:21 +0800] "GET //shop/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:21 +0800] "GET //wp1/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:21 +0800] "GET //test/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:21 +0800] "GET //media/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:22 +0800] "GET //wp2/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:22 +0800] "GET //site/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:22 +0800] "GET //cms/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:22 +0800] "GET //sito/wp-includes/wlwmanifest.xml HTTP/1.1" 403 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"

34.174.217.120 - - [05/Mar/2023:10:49:22 +0800] "" 400 0 "-" "-"

        其次，比对核实相关网站程序文件中并无前述目录和文件，如wp2/wp-includes/wlwmanifest.xml，初步判断案涉危险动作系黑客扫描试探网站漏洞行为。

        第三，查询核实ip为34.174.217.120的相关情况如下：

        综合以上情况，可以初步认定 IP为34.174.217.120当前用户系利用谷歌云提供的服务器进行漏洞扫描和恶意攻击，并非谷歌搜索引擎的正常网络爬虫所为，您完全可以根据自身实际情况予以封禁屏蔽处理。

        如您对本文有任何疑问，可以加微信进行深入交流。