服务器突然被提醒流量被用完了，感觉平时都没有，查看日志发现有攻击者使用了分布式 IP 池（短时间内几十个不同 IP）和端脑端动态 UA 变体（Chrome 105.0.0.x 的随机后缀）。不断获取首页，赶紧先限制了电脑段页面，部分日志如下
[14/Aug/2025:12:36:00 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.05 Safari/537.36＂
113.75.243.68 - - [14/Aug/2025:12:36:01 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.92 Safari/537.36＂
183.4.25.164 - - [14/Aug/2025:12:36:02 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.11 Safari/537.36＂
113.64.127.197 - - [14/Aug/2025:12:36:03 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.99 Safari/537.36＂
113.95.200.251 - - [14/Aug/2025:12:36:03 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.87 Safari/537.36＂
14.208.203.142 - - [14/Aug/2025:12:36:04 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.00 Safari/537.36＂
116.28.179.190 - - [14/Aug/2025:12:36:04 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.15 Safari/537.36＂
119.135.57.6 - - [14/Aug/2025:12:36:04 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.50 Safari/537.36＂
113.101.72.128 - - [14/Aug/2025:12:36:04 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.85 Safari/537.36＂
113.64.160.92 - - [14/Aug/2025:12:36:06 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.10 Safari/537.36＂
113.101.228.149 - - [14/Aug/2025:12:36:07 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.70 Safari/537.36＂
183.21.247.71 - - [14/Aug/2025:12:36:07 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.99 Safari/537.36＂
116.16.225.211 - - [14/Aug/2025:12:36:07 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.98 Safari/537.36＂
183.35.191.94 - - [14/Aug/2025:12:36:07 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.01 Safari/537.36＂
113.64.111.108 - - [14/Aug/2025:12:36:08 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.85 Safari/537.36＂
116.26.165.29 - - [14/Aug/2025:12:36:11 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.23 Safari/537.36＂
183.24.172.188 - - [14/Aug/2025:12:36:14 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.56 Safari/537.36＂
119.138.246.140 - - [14/Aug/2025:12:36:15 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.08 Safari/537.36＂
113.102.68.174 - - [14/Aug/2025:12:36:18 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.74 Safari/537.36＂
113.82.191.174 - - [14/Aug/2025:12:36:19 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.01 Safari/537.36＂
113.101.182.160 - - [14/Aug/2025:12:36:19 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.93 Safari/537.36＂
183.21.230.243 - - [14/Aug/2025:12:36:19 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.26 Safari/537.36＂
183.29.154.171 - - [14/Aug/2025:12:36:20 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.31 Safari/537.36＂
125.89.208.15 - - [14/Aug/2025:12:36:20 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.12 Safari/537.36＂
113.85.223.141 - - [14/Aug/2025:12:36:20 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.40 Safari/537.36＂
183.10.253.137 - - [14/Aug/2025:12:36:20 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.60 Safari/537.36＂
59.35.86.3 - - [14/Aug/2025:12:36:20 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.79 Safari/537.36＂
113.95.168.102 - - [14/Aug/2025:12:36:22 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.84 Safari/537.36＂
113.75.205.164 - - [14/Aug/2025:12:36:22 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.04 Safari/537.36＂
183.36.143.84 - - [14/Aug/2025:12:36:22 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.81 Safari/537.36＂
113.82.173.197 - - [14/Aug/2025:12:36:22 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.11 Safari/537.36＂
113.75.202.15 - - [14/Aug/2025:12:36:22 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.68 Safari/537.36＂
183.1.90.37 - - [14/Aug/2025:12:36:22 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.53 Safari/537.36＂
119.138.204.187 - - [14/Aug/2025:12:36:23 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.87 Safari/537.36＂
116.5.167.19 - - [14/Aug/2025:12:36:24 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.71 Safari/537.36＂
125.89.247.183 - - [14/Aug/2025:12:36:24 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.98 Safari/537.36＂
119.125.102.172 - - [14/Aug/2025:12:36:24 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.28 Safari/537.36＂
218.15.220.157 - - [14/Aug/2025:12:36:28 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.21 Safari/537.36＂
113.117.60.21 - - [14/Aug/2025:12:36:29 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.78 Safari/537.36＂
125.89.208.235 - - [14/Aug/2025:12:36:30 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.47 Safari/537.36＂
116.26.171.44 - - [14/Aug/2025:12:36:30 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.22 Safari/537.36＂
116.28.236.63 - - [14/Aug/2025:12:36:31 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.12 Safari/537.36＂
119.134.45.74 - - [14/Aug/2025:12:36:32 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.33 Safari/537.36＂
113.75.160.38 - - [14/Aug/2025:12:36:33 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.69 Safari/537.36＂
116.19.200.113 - - [14/Aug/2025:12:36:33 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.92 Safari/537.36＂
119.125.133.169 - - [14/Aug/2025:12:36:35 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.86 Safari/537.36＂
113.110.67.184 - - [14/Aug/2025:12:36:37 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.61 Safari/537.36＂
113.101.82.201 - - [14/Aug/2025:12:36:37 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.66 Safari/537.36＂
183.4.16.233 - - [14/Aug/2025:12:36:40 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.68 Safari/537.36＂
113.85.216.164 - - [14/Aug/2025:12:36:41 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.03 Safari/537.36＂
113.64.124.101 - - [14/Aug/2025:12:36:42 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.01 Safari/537.36＂
113.101.236.117 - - [14/Aug/2025:12:36:42 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.89 Safari/537.36＂
113.100.97.147 - - [14/Aug/2025:12:36:43 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.41 Safari/537.36＂
183.24.177.77 - - [14/Aug/2025:12:36:45 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.94 Safari/537.36＂
116.29.182.206 - - [14/Aug/2025:12:36:45 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.42 Safari/537.36＂
113.74.168.90 - - [14/Aug/2025:12:36:46 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.31 Safari/537.36＂
113.64.113.248 - - [14/Aug/2025:12:36:46 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.41 Safari/537.36＂
113.86.175.114 - - [14/Aug/2025:12:36:47 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.76 Safari/537.36＂
119.138.40.234 - - [14/Aug/2025:12:36:49 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.14 Safari/537.36＂
183.19.138.48 - - [14/Aug/2025:12:36:52 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.83 Safari/537.36＂
119.125.71.21 - - [14/Aug/2025:12:36:53 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.24 Safari/537.36＂
113.85.241.249 - - [14/Aug/2025:12:36:54 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.39 Safari/537.36＂
116.26.230.124 - - [14/Aug/2025:12:36:55 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.60 Safari/537.36＂
14.121.215.36 - - [14/Aug/2025:12:36:56 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.36 Safari/537.36＂
113.100.177.57 - - [14/Aug/2025:12:36:56 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.46 Safari/537.36＂
113.102.17.174 - - [14/Aug/2025:12:36:57 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.83 Safari/537.36＂
116.29.254.156 - - [14/Aug/2025:12:36:59 +0800] ＂GET / HTTP/1.1＂ 444 0 ＂-＂ ＂Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.06 Safari/537.36＂用豆包AI进行分析：
从日志来看，攻击者使用了分布式 IP 池（短时间内几十个不同 IP）和动态 UA 变体（Chrome 105.0.0.x 的随机后缀），属于典型的 “分布式低频攻击”—— 单个 IP 只请求 1 次，但整体频率极高。这种攻击绕过了单 IP 频率限制，需要从 **“攻击流量的共性特征”** 入手拦截，同时通过 “正常用户 / 搜索引擎的独特特征” 放行，具体方案如下：
一、提炼攻击流量的 “共性特征”，精准拦截
虽然 IP 和 UA 在变，但攻击请求有明显的 “非人类行为” 特征，可通过 Nginx 配置直接拦截：
1. 拦截 “请求头不完整” 的异常流量
正常浏览器的 HTTP 请求头会包含完整的Accept、Accept-Language、Connection等字段，而攻击脚本往往简化请求头（只带必要字段）。日志中所有请求均为"GET / HTTP/1.1"且Referer为空，可针对性拦截：
Referer 是什么？
Referer（注意拼写，正确应为 “Referrer”，但 HTTP 协议中沿用了拼写错误 “Referer”）是 HTTP 请求头 中的一个字段，用于记录当前请求是从哪个页面（或 URL）跳转过来的。它的主要作用是追踪用户的访问来源，帮助服务器了解请求的上下文。
Referer 属于哪一部分？
Referer 属于 HTTP 请求头（Request Headers） 的一部分。
- 在浏览器发送 HTTP 请求（如访问网页、加载图片、调用 API 等）时，会自动在请求头中添加
Referer字段（特殊情况除外，见下文），其值为触发当前请求的页面 URL。 - 服务器接收到请求后，可以通过读取
Referer字段获取来源信息，常用于：- 统计访问来源（如用户从百度搜索、微信链接还是直接输入网址进入网站）；
- 防盗链（如限制非本网站域名的请求加载图片或视频）；
- 安全验证（如防止跨站请求伪造 CSRF 攻击）。
特殊情况：Referer 可能不存在或被隐藏
- 直接在浏览器地址栏输入 URL 访问（无来源页面）；
- 从 HTTPS 页面跳转到 HTTP 页面（出于安全考虑，浏览器会隐藏 Referer）；
- 页面通过
meta标签或响应头设置了Referrer-Policy（可控制 Referer 的发送规则，如完全不发送、仅发送域名等）。 - 该请求是通过脚本（如后端程序调用、API 接口请求）发起的，而非通过浏览器页面跳转（脚本默认不会自动添加
Referer）；这类场景下Referer为空是常见现象。
例如，页面添加 <meta name="referrer" content="no-referrer"> 后，从该页面触发的请求将不会包含 Referer 字段。
在 Nginx 配置中添加：
server {
...
# 拦截Referer为空的请求（正常用户访问通常有Referer或浏览器会自动填充）
if ($http_referer = "") {
# 排除搜索引擎爬虫（避免误封）
if ($is_bot = 0) {
return 444; # 对非爬虫的空Referer请求直接关闭连接
}
}
# 拦截Accept字段不标准的请求（正常浏览器会带Accept: text/html,application/xhtml+xml...）
if ($http_accept !~* "text/html,application/xhtml\+xml,application/xml;q=0.9,*/*;q=0.8") {
if ($is_bot = 0) {
return 444;
}
}
# 拦截Connection字段异常的请求（攻击脚本可能用close而非keep-alive）
if ($http_connection !~* "keep-alive") {
if ($is_bot = 0) {
return 444;
}
}
...
}原理：攻击脚本为了提高效率，会简化请求头，而正常浏览器（包括搜索引擎爬虫）的请求头更规范，通过校验请求头完整性可过滤 80% 以上的攻击流量。但是我有后台api,有app直接调用首页，所以这种方法不能用。如果要用还要收集APP合法ua等工作麻烦.
暂时除了禁止相应的ua暂时无法？
