185.156.47.9 - - [07/Aug/2026:11:54:17 +0800] "GET /wp-login.php HTTP/1.1" 200 8459 "[https://www.bing.com/](https://www.bing.com/)" "Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:119.0) Gecko/20100101 Firefox/119.0" "-"185.156.47.9 - - [07/Aug/2026:11:54:17 +0800] "GET /?author=1 HTTP/1.1" 200 51779 "" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" "-"185.156.47.9 - - [07/Aug/2026:11:54:18 +0800] "GET /?author=2 HTTP/1.1" 404 42828 "[https://wordpress.org/](https://wordpress.org/)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15" "-"185.156.47.9 - - [07/Aug/2026:11:54:18 +0800] "GET /?author=3 HTTP/1.1" 404 42828 "[https://www.google.com/](https://www.google.com/)" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0) Gecko/20100101 Firefox/120.0" "-"185.156.47.9 - - [07/Aug/2026:11:54:18 +0800] "GET /?author=4 HTTP/1.1" 404 42828 "[https://www.facebook.com/](https://www.facebook.com/)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15" "-"185.156.47.9 - - [07/Aug/2026:11:54:19 +0800] "GET /?author=5 HTTP/1.1" 404 42828 "[https://www.bing.com/](https://www.bing.com/)" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" "-"185.156.47.9 - - [07/Aug/2026:11:54:19 +0800] "GET /wp-json/wp/v2/users HTTP/1.1" 200 811 "[https://www.google.com/](https://www.google.com/)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15" "-"185.156.47.9 - - [07/Aug/2026:11:54:19 +0800] "POST /wp-login.php HTTP/1.1" 200 8822 "[https://114.35.81.57/wp-login.php](https://114.35.81.57/wp-login.php)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15" "-"185.156.47.9 - - [07/Aug/2026:11:54:20 +0800] "GET /wp-admin/index.php HTTP/1.1" 302 5 "[https://114.35.81.57/wp-login.php](https://114.35.81.57/wp-login.php)" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" "-"185.156.47.9 - - [07/Aug/2026:11:54:21 +0800] "GET /wp-login.php?redirect_to=https%3A%2F%2F114.35.81.57%2Fwp-admin%2Findex.php&reauth=1 HTTP/1.1" 200 8558 "[https://114.35.81.57/wp-login.php](https://114.35.81.57/wp-login.php)" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36" "-"185.156.47.9 - - [07/Aug/2026:11:54:21 +0800] "POST /wp-login.php HTTP/1.1" 200 8822 "[https://114.35.81.57/wp-login.php](https://114.35.81.57/wp-login.php)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15" "-"
🚨 警報：這段日誌顯示您的 WordPress 已經被「精準爆破」！
這段日誌記錄了一次極度危險且技術非常典型的 WordPress 惡意攻擊行為。攻擊者 IP 為 185.156.47.9，最糟糕的是，您目前的 nginx-4xx 規則對這種攻擊完全無效。
以下為您詳細拆解駭客的每一步陰謀，以及為什麼它能躲過防禦：
🔍 駭客攻擊行為全拆解
第一步：探測登入頁面
GET /wp-login.php ... 200 8459
第二步：惡意「列舉」您的管理員帳號（User Enumeration）
WordPress 預設有一個漏洞，透過特定參數可以猜出網站的管理者帳號名稱。
GET /?author=1 ... 200 ➔ 成功！這代表他抓到了您的第一個使用者帳號（通常是 admin 或您常用的名字）。GET /?author=2 ~ author=5 ➔ 回傳 404，代表網站沒有第 2~5 個使用者。GET /wp-json/wp/v2/users ... 200 ➔ 駭客利用 WordPress 內建的 API，再度成功撈出了您網站上所有公開的帳號清單。第三步：開始進行密碼爆破（POST 攻擊）
POST /wp-login.php ... 200 8822
200 狀態碼（只是畫面上顯示密碼錯誤）。GET /wp-admin/index.php ... 302 ➔ 隨後他嘗試硬闖後台，被系統重新導向（302）。POST /wp-login.php ... 200 ➔ 換了另一組密碼，繼續嘗試爆破。