- riceawa2026-08-23
如图，我的sub2api一直被国内ip爆破，没开放注册，之前是自用的然后分享点额度送给佬们蹬，佬们推荐把国内ipban了吗
下面是攻击ip,大家有类似服务可以把这些ipban了
总结
二、主要攻击者（Top 20）
IP |
失败登录次数 |
归属 |
状态 |182.255.82.168 |
2505 |
5GN/Multacom (AU) |
^-^ 已封禁 |39.98.76.71 |
1026 |
阿里云 |
^-^ 已封禁 |47.92.239.70 |
925 |
阿里云 |
^-^ 已封禁 |123.154.213.203 |
650 |
联通浙江 |
^-^ 已封禁 |14.145.3.76 |
380 |
电信广东 |
^-^ 已封禁 |61.148.74.134 |
368 |
联通北京 |
^-^ 已封禁 |103.62.49.170 |
130 |
- |
^-^ 已封禁 |43.255.119.13 |
115 |
中科三方 (VPS) |
^-^ 已封禁 |47.79.37.144 |
112 |
阿里云 |
^-^ 已封禁 |156.226.169.26 |
110 |
联通安徽 |
^-^ 已封禁 |120.235.136.123 |
110 |
电信广东 |
^-^ 已封禁 |112.2.86.236 |
110 |
联通江苏 |
^-^ 已封禁 |134.195.101.88 |
90 |
- |
^-^ 已封禁 |156.226.169.46 |
89 |
- |
^-^ 已封禁 |45.207.154.51 |
80 |
- |
^-^ 已封禁 |103.62.49.178 |
75 |
- |
^-^ 已封禁 |141.11.90.248 |
62 |
- |
^-^ 已封禁 |43.255.119.18 |
54 |
- |
^-^ 已封禁 |43.255.119.9 |
53 |
- |
^-^ 已封禁 |43.255.119.5 |
52 |
- |
^-^ 已封禁 |三、完整爆破 IP 列表（全部触发失败登录）
IP |
失败次数 |
是否已封禁(≥5) |182.255.82.168 |
2505 |
|39.98.76.71 |
1026 | |47.92.239.70 |
925 | |123.154.213.203 |
650 | |14.145.3.76 |
380 | |61.148.74.134 |
368 | |103.62.49.170 |
130 | |43.255.119.13 |
115 | |47.79.37.144 |
112 | |156.226.169.26 |
110 | |120.235.136.123 |
110 | |112.2.86.236 |
110 | |134.195.101.88 |
90 | |156.226.169.46 |
89 | |45.207.154.51 |
80 | |103.62.49.178 |
75 | |141.11.90.248 |
62 | |43.255.119.18 |
54 | |43.255.119.9 |
53 | |43.255.119.5 |
52 | |43.255.119.4 |
52 | |107.189.28.30 |
50 | |203.10.99.12 |
42 | |113.137.137.211 |
42 | |192.3.193.240 |
40 | |157.254.234.193 |
40 | |156.224.76.48 |
40 | |78.142.192.54 |
39 | |194.50.154.20 |
39 | |64.83.40.132 |
38 | |217.142.144.107 |
38 | |203.10.99.59 |
38 | |166.88.95.152 |
38 | |103.151.173.203 |
37 | |43.255.119.7 |
36 | |141.11.133.251 |
36 | |141.11.133.248 |
35 | |141.11.133.253 |
34 | |141.11.133.250 |
34 | |103.62.49.162 |
33 | |42.2.6.25 |
32 | |82.109.60.100 |
31 | |130.94.37.210 |
31 | |23.145.24.11 |
26 | |54.250.195.126 |
23 | |52.195.178.70 |
23 | |64.186.250.53 |
22 | |106.52.251.120 |
21 | |5.34.218.98 |
20 | |43.255.119.12 |
20 | |18.183.84.152 |
20 | |167.254.240.89 |
20 | |14.145.3.195 |
20 | |45.93.30.138 |
19 | |43.255.119.8 |
19 | |43.255.119.14 |
18 | |43.255.119.11 |
18 | |141.11.133.246 |
18 | |141.11.133.242 |
18 | |192.3.110.141 |
17 | |107.155.15.46 |
17 | |54.37.84.93 |
16 | |207.46.224.86 |
16 | |154.36.157.131 |
16 | |120.245.114.97 |
16 | |120.245.114.75 |
16 | |43.255.119.17 |
15 | |64.118.152.48 |
13 | |35.79.225.10 |
12 | |141.11.133.243 |
12 | |13.158.3.66 |
12 |
— |103.224.172.246 |
12 | |58.153.1.36 |
11 | |42.236.168.247 |
11 | |16.216.65.181 |
9 |
— |146.235.192.128 |
9 | |23.97.62.131 |
8 | |23.97.62.130 |
8 | |23.97.62.119 |
8 | |23.97.62.114 |
8 | |203.10.99.28 |
8 | |13.158.34.225 |
8 |
— |81.28.13.138 |
7 | |188.253.7.9 |
7 | |103.175.98.23 |
7 | |185.225.20.138 |
6 | |52.193.242.116 |
5 | |主楼 - 正义的黄瓜2026-08-23
- jetty2026-08-23
我也是，我目前的做法是密码强度极高，然后开启2fa，然后发现哪个ip就阻断它 （iptables好像是）
- linuxdoo2026-08-23
似乎sub2api很多这样的ip爆破，不过用国内的ip是没想到的
- mjjss-linuxdo2026-08-23
好像站里有防止CPA 被扫的 你看看。这个有什么好办法吗
- 纸雨🍥2026-08-23
天天脚本小子扫啊扫、撞啊撞，统统给他IPban掉
- 一吟Faith2026-08-23
我是这样做的
把[[email protected]](https://feedbbs.com/cdn-cgi/l/email-protection)默认用户名改一下。默认端口也改一下，同时为了防止端口扫描扫出来，用nginx设定规则鉴权，必须要包含特定header请求头才能访问（设复杂一点）同时套个cdn，在cdn控制台的“出站请求”加上该header请求头。
这样的话，直接ip:port就访问不到了，只有通过域名再经过cdn才能访问
最后再在cdn控制台把国内ip封一下，我只封了网站页面访问，api调用国内不影响（把那几个路径/v1/,/v1beta/之类的排除一下就好）
- arima-linuxdo2026-08-23
装上fail2ban，套上cf，改端口，就差不多了
- aqqwiyth2026-08-23
用IP池大量爆破成功了才是自己的号进场 ^-^
- 廿四2026-08-23
我的做法是套cf，加turnstile，自动脚本封禁爆破ip