80.82.77.202 - - [07/Aug/2026:01:33:26 +0800] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x03\xD5\x0Cg\x97l\xDA\xDA\xE0\x1E\xC6\xAF)\xC2P\x81\x80\x81*\xAE\xBBb\x01f\xC0MD\xF7*\xCD\xD1\xF7\x9D \x02P\xF4\x878\x0F\xD3\x85\x96\xF8 \xF6Svp6\x07\x062\xC0\xD3]\x16'\xBCh\xDC\xF3%\x10\x82\xA5\x00&\xC0+\xC0/\xC0,\xC00\xCC\xA9\xCC\xA8\xC0\x09\xC0\x13\xC0" 400 157 "-" "-" "-" 80.82.77.202 - - [07/Aug/2026:01:33:26 +0800] "GET /aaa9 HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" "-" 80.82.77.202 - - [07/Aug/2026:01:33:27 +0800] "\x16\x03\x01\x00\xEE\x01\x00\x00\xEA\x03\x03Z\xFD\x19\xD8*\x1A\x19,\xDF3\x18+%\x8C\xC0.\xD3\x0Bq\x84\x87H\x9D{\xC2\x9A\x1E\x9D\x0C\xD5\xB4\xCA \xE3\xE6\x87F\xC9M" 400 157 "-" "-" "-" 80.82.77.202 - - [07/Aug/2026:01:33:27 +0800] "GET /aab9 HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" "-" 45.156.128.13 - - [07/Aug/2026:01:33:42 +0800] "GET / HTTP/1.1" 200 51353 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.13 - - [07/Aug/2026:01:33:45 +0800] "GET /license.txt HTTP/1.1" 200 19903 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.14 - - [07/Aug/2026:01:33:47 +0800] "GET /wp-content/plugins/elementor/readme.txt HTTP/1.1" 404 42741 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.14 - - [07/Aug/2026:01:33:47 +0800] "GET /wp-content/plugins/wordpress-seo/readme.txt HTTP/1.1" 404 42741 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.13 - - [07/Aug/2026:01:33:47 +0800] "GET /wp-content/plugins/wordfence/readme.txt HTTP/1.1" 404 42733 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.10 - - [07/Aug/2026:01:33:47 +0800] "GET /wp-content/plugins/contact-form-7/readme.txt HTTP/1.1" 404 42733 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.13 - - [07/Aug/2026:01:33:47 +0800] "GET /wp-content/plugins/woocommerce/readme.txt HTTP/1.1" 404 42733 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.15 - - [07/Aug/2026:01:33:47 +0800] "GET /wp-content/plugins/wpforms-lite/readme.txt HTTP/1.1" 404 42741 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.14 - - [07/Aug/2026:01:33:47 +0800] "GET /wp-content/plugins/jetpack/readme.txt HTTP/1.1" 404 42741 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.15 - - [07/Aug/2026:01:33:47 +0800] "GET /wp-content/plugins/duplicate-post/readme.txt HTTP/1.1" 404 42733 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.13 - - [07/Aug/2026:01:33:47 +0800] "GET /wp-content/plugins/litespeed-cache/readme.txt HTTP/1.1" 404 42733 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.15 - - [07/Aug/2026:01:33:47 +0800] "GET /wp-content/plugins/duplicate-page/readme.txt HTTP/1.1" 404 42733 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.10 - - [07/Aug/2026:01:33:47 +0800] "GET /wp-content/plugins/all-in-one-wp-migration/readme.txt HTTP/1.1" 404 42741 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.13 - - [07/Aug/2026:01:33:47 +0800] "GET /wp-content/plugins/google-site-kit/readme.txt HTTP/1.1" 404 42733 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.14 - - [07/Aug/2026:01:33:47 +0800] "GET /wp-content/plugins/updraftplus/readme.txt HTTP/1.1" 404 42733 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.10 - - [07/Aug/2026:01:33:47 +0800] "GET /wp-content/plugins/limit-login-attempts-reloaded/readme.txt HTTP/1.1" 404 42741 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.14 - - [07/Aug/2026:01:33:47 +0800] "GET /wp-content/plugins/all-in-one-seo-pack/readme.txt HTTP/1.1" 404 42741 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-" 45.156.128.15 - - [07/Aug/2026:01:33:47 +0800] "GET /wp-content/plugins/akismet/readme.txt HTTP/1.1" 200 6677 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 Safari/537.36" "-"
這段日誌記錄了兩個非常具有代表性的惡意攻擊事件：前段是探測 SSL 漏洞的機器人，後段則是利用「分布式 IP 網段」對您 WordPress 進行精準外掛探測的集團式駭客行為。
以下為您詳細拆解這兩組 IP 的攻擊手法與深層意圖：
80.82.77.202）這隻機器人在 2 秒鐘內交替發送了二進位加密封包與標準網頁請求：
\x16\x03\x01...）➔ 400 157：這同樣是標準的 HTTPS Client Hello 握手特徵。黑客故意把加密的 TLS 封包丟進您不加密的 Port 80，企圖盲測 Nginx 的緩衝區溢位或協定解析漏洞，被 Nginx 用 400 錯誤直接彈開。/aaa9、/aab9）➔ 404 555：黑客在發送亂碼的空檔，立刻切換成標準瀏覽器外殼，隨機敲門探測不存在的測試路徑。這屬於典型的自動化盲掃，被 Nginx 用 404 打槍。45.156.128.x 網段）這段日誌最值得警惕！駭客動用了 45.156.128.10、.13、.14、.15 四個同網段的不同的實體 IP，在 01:33:47 這一秒鐘內，聯手對您的網站發動了對稱式的「外掛偵查戰」：
200 19903：45.156.128.13 成功讀取了您網站根目錄下的 license.txt（WordPress 官方許可證說明檔，回傳了 19 KB 資料）。黑客藉此百分之百確認了您這台伺服器跑的是 WordPress 系統。readme.txt（01:33:47 🌟 關鍵一秒）：黑客拿著一整套全球下載量前 20 名的熱門外掛清單（如 Elementor、Yoast SEO、Wordfence、WooCommerce、LiteSpeed Cache、Jetpack 等），瘋狂探測它們目錄下的 readme.txt 檔案。
readme.txt 裡面會毫無防備地寫著該外掛目前安裝的精確版本號。駭客想透過這些檔案判定您裝了哪些外掛、版本是多少。一旦對齊到「含有已知漏洞的舊版本」，接下來就會立刻發射對應的 RCE 木馬武器。200 6677：請注意最後一行：45.156.128.15 成功讀取到了 /plugins/akismet/readme.txt（回應 200，吐出 6.6 KB 資料）。這代表黑客成功知道了您有安裝 Akismet（反垃圾留言）外掛，且拿到了它的版本號。DOCKER-USER 捕獸夾」下會受到什麼制裁？這份日誌記錄的時間在 01:33 分。在您稍早剛剛校正完美的 DOCKER-USER + maxretry = 3 防線下，這群自以為聰明的分布式集團軍，其下場會非常慘烈：
同秒集體超標，觸發全面封鎖：雖然駭客狡猾地使用了 .10、.13、.14、.15 四台機器互相掩護、分工探測。但因為您的 maxretry 只有 3 次，這四台機器在 01:33:47 這一秒鐘內，各自都點擊了 4~5 個不存在的外掛路徑（觸發 404）。
全部關進 f2b-nginx-4xx 小黑屋：在這一秒鐘的尾聲，這四個 IP 將會集體超標，全部被 Fail2ban 判定為惡意掃描器。
實戰成果印證：如果您回頭去對照您先前貼出的 f2b-nginx-4xx 終極處決名單：沒錯！這四個 IP 早就整整齊齊地躺在您的底層防火牆裡被執行死刑了！
-A f2b-nginx-4xx -s 45.156.128.15/32 -j REJECT
-A f2b-nginx-4xx -s 45.156.128.14/32 -j REJECT
-A f2b-nginx-4xx -s 45.156.128.13/32 -j REJECT
-A f2b-nginx-4xx -s 45.156.128.10/32 -j REJECT