103.59.156.16 - - [06/Aug/2026:23:02:56 +0800] "GET / HTTP/1.1" 200 105 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-us; SCH-I535 Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30" "-"217.146.80.102 - - [06/Aug/2026:23:09:23 +0800] "GET / HTTP/1.1" 301 169 "-" "Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)" "-"89.37.172.131 - - [06/Aug/2026:23:09:42 +0800] "GET / HTTP/1.1" 301 169 "-" "Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)" "-"193.176.29.12 - - [06/Aug/2026:23:09:43 +0800] "GET / HTTP/1.1" 200 51345 "-" "Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)" "-"5.226.140.4 - - [06/Aug/2026:23:09:45 +0800] "GET /favicon.ico HTTP/1.1" 302 5 "-" "Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)" "-"37.10.113.218 - - [06/Aug/2026:23:09:46 +0800] "GET /wp-includes/images/w-logo-blue-white-bg.png HTTP/1.1" 200 4119 "-" "Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)" "-"5.226.140.13 - - [06/Aug/2026:23:09:46 +0800] "GET /mcp HTTP/1.1" 404 42741 "-" "Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)" "-"188.240.59.6 - - [06/Aug/2026:23:09:46 +0800] "GET /api/mcp HTTP/1.1" 404 42733 "-" "Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)" "-"81.19.219.194 - - [06/Aug/2026:23:09:46 +0800] "GET / HTTP/1.1" 200 51353 "-" "Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)" "-"31.14.254.21 - - [06/Aug/2026:23:09:47 +0800] "GET /mcp/ HTTP/1.1" 404 42741 "-" "Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)" "-"81.19.219.219 - - [06/Aug/2026:23:09:48 +0800] "GET /sse HTTP/1.1" 404 42710 "-" "Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/)" "-"5.61.209.92 - - [06/Aug/2026:23:11:16 +0800] "GET /SDK/webLanguage HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 Edg/90.0.818.46" "-"94.154.43.254 - - [06/Aug/2026:23:17:56 +0800] "GET / HTTP/1.1" 301 169 "-" "Linux Gnu (cow)" "-"45.205.1.122 - - [06/Aug/2026:23:42:34 +0800] "GET / HTTP/1.1" 301 169 "-" "-" "-"216.73.216.62 - - [06/Aug/2026:23:52:37 +0800] "GET /robots.txt HTTP/1.1" 200 136 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])" "-"216.73.216.62 - - [06/Aug/2026:23:52:37 +0800] "GET /wp-sitemap.xml HTTP/1.1" 200 693 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected])" "-"198.235.24.2 - - [06/Aug/2026:23:57:02 +0800] "GET / HTTP/1.1" 301 169 "-" "Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity" "-"198.235.24.2 - - [06/Aug/2026:23:57:02 +0800] "GET / HTTP/1.1" 200 51353 "http://114.35.81.57:80/" "Hello from Palo Alto Networks, find out more about our scans in https://docs-cortex.paloaltonetworks.com/r/1/Cortex-Xpanse/Scanning-activity" "-"
這段日誌記錄了多種不同性質的外網流量，其中最亮眼的是：您的網站迎來了 AI 巨頭 Anthropic 的官方爬蟲，同時也展示了資安公司如何破解您的 IP 跳轉機制。
以下為您詳細拆解這段日誌中隱藏的三大核心現象與特徵：
ClaudeBot216.73.216.62（"ClaudeBot/1.0"）➔ 回應 200
/robots.txt（網站爬蟲規則）與 /wp-sitemap.xml（網站地圖）。它是非常守規矩的合法爬蟲，目的是將您網站上的公開文章納入 AI 的知識庫進行學習。這種連線是完全安全且良性的。Palo Alto Networks198.235.24.2（Cortex-Xpanse 掃描器）➔ 出現 301 隨後 200 51353
301 169）。但它的腳本極度聰明，立刻順著 301 跳轉，用帶有來源標頭（http://114.35.81.57:80/）的加密連線再次闖入。51353 位元組，約 51 KB）。這證明這類頂級資安公司的探測工具，會自動破解簡單的網址跳轉。Infrawatch 聯手轟炸請注意 23:09:23 到 23:09:48 這段高密度的 Infrawatch 機構日誌：
217.146.80.102、89.37.172.131：先用 HTTP 打頭陣，觸發 301。193.176.29.12：順著 301 成功摸進首頁（200）。37.10.113.218：甚至去讀取了 WordPress 內建的預設商標圖片（/w-logo-blue-white-bg.png）。5.226.140.13、188.240.59.6、31.14.254.21、81.19.219.219：這四個不同的 IP 同在 23:09:46 ~ 23:09:48 這一秒內，同時對您發起 /mcp、/api/mcp、/sse 的物聯網後台掃描！42741 位元組（42 KB）的防禦大怪獸。這正是我們上一題提到的「頻寬與 CPU 隱形殺手」。DOCKER-USER 防線」有多麼及時！這段日誌發生的時間集中在 23:09 ~ 23:57 之間。