网站又被人C了，nginx怎么过滤？

花开花落

小网站加了360的网站卫士CDN，无奈还是防不住。网站一直被人C。看了一下日志。发现攻击都是有规律的。。。
61.160.224.145 - - [16/Jun/2016:19:52:20 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 120.25.144.39
61.160.224.145 - - [16/Jun/2016:19:52:20 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; SV1)" 202.201.255.227
61.160.224.144 - - [16/Jun/2016:19:52:20 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SV1)" 183.136.236.170
61.160.224.145 - - [16/Jun/2016:19:52:20 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 183.104.247.104
61.160.224.143 - - [16/Jun/2016:19:52:20 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 120.25.144.39
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; SV1)" 113.161.24.94
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 180.166.189.86
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 120.92.21.136
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 120.25.144.39
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 120.25.144.39
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; SV1)" 121.42.36.167
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1)" 113.161.24.94
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 183.104.247.104
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 120.25.144.39
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 182.254.155.89
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 126.117.74.151
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 180.166.189.86
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; SV1)" 120.27.101.111
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 111.63.23.204
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 115.159.149.66
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 126.117.74.151
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)" 180.166.189.86
61.160.224.145 - - [16/Jun/2016:19:52:21 +0800] "GET / HTTP/1.0" 200 5217 "-" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; SV1)" 113.161.24.94

求大神指导一下，nginx怎样过滤这样的攻击？

花开花落

花开花败 发表于 2016-6-16 22:18
就冲楼主的ID也得来回复一下

我的ID咋了嘛

悠悠

直接NULL掉IP会不会好一些

花开花落

悠悠 发表于 2016-6-16 22:01
直接NULL掉IP会不会好一些

IP太多。。。有人花了钱打我的网站的

每次醒来

这IP是  江苏省常州市 北京奇虎科技有限公司电信CDN节点

龟龟酱

因为有cdn的原因。。。根本统计不到真实来源。

花开花落

龟龟酱 发表于 2016-6-16 22:02
因为有cdn的原因。。。根本统计不到真实来源。

能不能根据这些攻击的特征进行屏蔽？

花开花落

每次醒来 发表于 2016-6-16 22:01
这IP是  江苏省常州市 北京奇虎科技有限公司电信CDN节点

后面的那个是真实IP吧

龟龟酱

花开花落 发表于 2016-6-16 22:04
能不能根据这些攻击的特征进行屏蔽？

我记得360家的cdn可以开验证码，直接验证码走起吧，要输入验证码才能访问那种

花开花落

龟龟酱 发表于 2016-6-16 22:06
我记得360家的cdn可以开验证码，直接验证码走起吧，要输入验证码才能访问那种 ...

开启了，不过会影响访问的啊

ZeroClover

开验证码就好了=。=