典型的自動化爆破工具行為

185.156.47.9 - - [07/Aug/2026:11:54:17 +0800] "GET /wp-login.php HTTP/1.1" 200 8459 "https://www.bing.com/" "Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:119.0) Gecko/20100101 Firefox/119.0" "-"185.156.47.9 - - [07/Aug/2026:11:54:17 +0800] "GET /?author=1 HTTP/1.1" 200 51779 "" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-"185.156.47.9 - - [07/Aug/2026:11:54:18 +0800] "GET /?author=2 HTTP/1.1" 404 42828 "https://wordpress.org/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15" "-"185.156.47.9 - - [07/Aug/2026:11:54:18 +0800] "GET /?author=3 HTTP/1.1" 404 42828 "https://www.google.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0" "-"185.156.47.9 - - [07/Aug/2026:11:54:18 +0800] "GET /?author=4 HTTP/1.1" 404 42828 "https://www.facebook.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15" "-"185.156.47.9 - - [07/Aug/2026:11:54:19 +0800] "GET /?author=5 HTTP/1.1" 404 42828 "https://www.bing.com/" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" "-"185.156.47.9 - - [07/Aug/2026:11:54:19 +0800] "GET /wp-json/wp/v2/users HTTP/1.1" 200 811 "https://www.google.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15" "-"185.156.47.9 - - [07/Aug/2026:11:54:19 +0800] "POST /wp-login.php HTTP/1.1" 200 8822 "https://114.35.81.57/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15" "-"185.156.47.9 - - [07/Aug/2026:11:54:20 +0800] "GET /wp-admin/index.php HTTP/1.1" 302 5 "https://114.35.81.57/wp-login.php" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" "-"185.156.47.9 - - [07/Aug/2026:11:54:21 +0800] "GET /wp-login.php?redirect_to=https%3A%2F%2F114.35.81.57%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 8558 "https://114.35.81.57/wp-login.php" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" "-"185.156.47.9 - - [07/Aug/2026:11:54:21 +0800] "POST /wp-login.php HTTP/1.1" 200 8822 "https://114.35.81.57/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" "-"185.156.47.9 - - [07/Aug/2026:11:54:22 +0800] "GET /wp-admin/index.php HTTP/1.1" 302 5 "https://114.35.81.57/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15" "-"185.156.47.9 - - [07/Aug/2026:11:54:22 +0800] "GET /wp-login.php?redirect_to=https%3A%2F%2F114.35.81.57%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 8558 "https://114.35.81.57/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15" "-"185.156.47.9 - - [07/Aug/2026:11:54:22 +0800] "POST /wp-login.php HTTP/1.1" 200 8825 "https://114.35.81.57/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0" "-"185.156.47.9 - - [07/Aug/2026:11:54:23 +0800] "GET /wp-admin/index.php HTTP/1.1" 302 5 "https://114.35.81.57/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" "-"185.156.47.9 - - [07/Aug/2026:11:54:23 +0800] "GET /wp-login.php?redirect_to=https%3A%2F%2F114.35.81.57%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 8558 "https://114.35.81.57/wp-login.php" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleW:

這是一次非常典型的自動化爆破工具行為。駭客為了避開安全偵測，故意在每次發送請求時，將 Referer（來源網頁） 偽裝成 Bing、Google、Facebook 等知名的合法網站。

從您新提供的日誌結尾可以看出，更嚴重的問題在於：

text

185.156.47.9 - - [07/Aug/2026:11:54:21 +0800] "POST /wp-login.php HTTP/1.1" 200 8822 ...
185.156.47.9 - - [07/Aug/2026:11:54:22 +0800] "GET /wp-admin/index.php HTTP/1.1" 302 5 ...
185.156.47.9 - - [07/Aug/2026:11:54:22 +0800] "POST /wp-login.php HTTP/1.1" 200 8825 ...
185.156.47.9 - - [07/Aug/2026:11:54:23 +0800] "GET /wp-admin/index.php HTTP/1.1" 302 5 ...

請謹慎使用程式碼。

在短短 2 秒內，該 IP 連續交替發送 POST /wp-login.php 與 GET /wp-admin/index.php。這代表工具正在使用自動化腳本，一邊猜密碼，一邊立刻測試是否成功跳轉進後台。

🛡️ 進階版設定：將 Referer 偽裝也納入防禦考量

雖然駭客把 Referer 偽裝得很好，但我們在 Fail2ban 裡完全不需要理會他的偽裝。

因為不論他的瀏覽器外殼或來源網址怎麼變，他在 Nginx 日誌裡留下的實體動作——**「短時間內對同一個登入頁面進行 POST 請求」與「惡意探測 ?author=1 參數」**的特徵是絕對藏不住的。

如果您想連同他探測惡意 Referer 的行為一併強化捕捉，可以將剛才為您設計的 wordpress-auth.conf 過濾器 微調得更寬鬆且更具侵略性：

打開過濾器檔案：

bash
```
sudo vim /etc/fail2ban/filter.d/wordpress-auth.conf
```
請謹慎使用程式碼。
確保內部的 failregex 包含以下三行核心防線：(這三行規則不看 Referer 是什麼，只要發現是這個 IP 在您的網站做這件事，就直接觸發計數。)

ini
```
[Definition]
failregex = ^<HOST> -.*"POST .*wp-login\.php HTTP/.*" 200
            ^<HOST> -.*"GET .*\?author=\d+ HTTP/.*" 200
            ^<HOST> -.*"GET .*wp-json/wp/v2/users HTTP/.*" 200
ignoreregex =
```
請謹慎使用程式碼。
儲存並重啟服務：

bash
```
sudo systemctl restart fail2ban
```
請謹慎使用程式碼。

🔍 測試與成效追蹤

當您將這套 WordPress 防爆破機制上線後，只要工具嘗試第 3 次密碼，nftables 就會立刻在系統底層將其完全切斷。

您可以透過這行指令，追蹤這台嘗試偽裝成 Bing 的機器人有沒有被成功逮捕：