blocks|key|90262|text|在我看来，有人使用僵尸网络试图利用共享的web凭据来危害您的网站，在晚上这样做是为了避免被发现。其他证据是“许多具有不同IP地址的设备请求网站的根”。如果这只是一个“病毒式”事件，那么只会展示某些类别的设备，而不是种类繁多的设备。访问网站的根目录--这些设备以前从未访问过您的网站。这不是拒绝服务攻击，因为他们是在晚上做的，因此不会拒绝任何人的服务，而晚上是入侵的自然时间。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|90263|我自己不是一个狂热的人，只是一个老派的开发人员，我甚至对ios也不是很熟悉，但我不能在你的网站被攻击的可能性下保持沉默，而你至少没有怀疑和调查。HTH。|90264|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

Looks to me like someone with a botnet is trying to take advantage of the shared web credentials to compromise your site, doing it at night to try to avoid detection. Other evidence is the "a lot of devices with different IP addresses request the root of the website". If it was just a "viral" event, just certain classes of devices would show, rather than a wide diversity of devices. Accessing the root of the web-site -- these are devices that have never been to your site before. It's not a denial of service attack because they are doing it at night, therefore not denying anybody their service, and night is the natural time for break-ins.

I'm not a cracker myself, just an old-school developer, and I'm not even terribly familiar with ios, but I could not remain silent while there was a possibility that your web site was attacked without you at least suspecting and investigating. HTH.

blocks|key|90317|text|swcd在iOS和macOS设备上运行，并会定期尝试访问/apple-app-site-association和/.well-known/apple-app-site-association。这用于在苹果原生应用程序和web之间进行调解的几个功能，包括Shared+Web+Credentials、Handoff和Universal+Links。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|90318|此过程通常会在用户所在的本地时区通宵运行，但不能保证特定的时间。|90319|有关关联域的更多信息，请参阅Setting+Up+an+App’s+Associated+Domains。|90320|如果不更多地了解你的产品，很难猜出峰值的原因--但可能有一些原因：|90321|90322|您最近发布了iOS或macOS应用程序的更新|unordered-list-item|90323|较大的客户刚刚注册了您的服务或向更多员工推出了您的产品|90324|较大的客户刚刚向其托管设备部署了iOS或macOS操作系统更新|90325|90326|不管怎样，我会忽略尖峰。如果它给您带来了麻烦，请确保您的负载均衡器配置正确。|90327|entityMap|0|LINK|mutability|MUTABLE|url|https://developer.apple.com/documentation/security/shared_web_credentials|1|https://developer.apple.com/library/archive/documentation/UserExperience/Conceptual/Handoff/HandoffFundamentals/HandoffFundamentals.html#//apple_ref/doc/uid/TP40014338|2|https://developer.apple.com/documentation/uikit/inter-process_communication/allowing_apps_and_websites_to_link_to_your_content/enabling_universal_links|3|https://developer.apple.com/documentation/security/password_autofill/setting_up_an_app_s_associated_domains#3001215^0|0|4|S|R|1K|13|3I|M|0|45|7|1|4D|F|2|0|0|E|12|3|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1A|8|@$9|1B|A|1C|B|C]|$9|1D|A|1E|B|C]|$9|1F|A|1G|B|C]]|D|@$9|1H|A|1I|1|1J]|$9|1K|A|1L|1|1M]|$9|1N|A|1O|1|1P]]|E|$]]|$1|F|3|G|5|6|7|1Q|8|@]|D|@]|E|$]]|$1|H|3|I|5|6|7|1R|8|@]|D|@$9|1S|A|1T|1|1U]]|E|$]]|$1|J|3|K|5|6|7|1V|8|@]|D|@]|E|$]]|$1|L|3|-4|5|6|7|1W|8|@]|D|@]|E|$]]|$1|M|3|N|5|O|7|1X|8|@]|D|@]|E|$]]|$1|P|3|Q|5|O|7|1Y|8|@]|D|@]|E|$]]|$1|R|3|S|5|O|7|1Z|8|@]|D|@]|E|$]]|$1|T|3|-4|5|6|7|20|8|@]|D|@]|E|$]]|$1|U|3|V|5|6|7|21|8|@]|D|@]|E|$]]|$1|W|3|-4|5|6|7|22|8|@]|D|@]|E|$]]]|X|$Y|$5|Z|10|11|E|$12|13]]|14|$5|Z|10|11|E|$12|15]]|16|$5|Z|10|11|E|$12|17]]|18|$5|Z|10|11|E|$12|19]]]]

<code>swcd</code> runs on iOS and macOS devices and will periodically attempt to access <code>/apple-app-site-association</code> and <code>/.well-known/apple-app-site-association</code>. This is used for several features which mediate between an Apple native app and the web, including <a href="https://developer.apple.com/documentation/security/shared_web_credentials" rel="noreferrer">Shared Web Credentials</a>, <a href="https://developer.apple.com/library/archive/documentation/UserExperience/Conceptual/Handoff/HandoffFundamentals/HandoffFundamentals.html#//apple_ref/doc/uid/TP40014338" rel="noreferrer">Handoff</a>, and <a href="https://developer.apple.com/documentation/uikit/inter-process_communication/allowing_apps_and_websites_to_link_to_your_content/enabling_universal_links" rel="noreferrer">Universal Links</a>.

This process will typically run overnight in the user's local time zone, but specific timing is not guaranteed.

See also <a href="https://developer.apple.com/documentation/security/password_autofill/setting_up_an_app_s_associated_domains#3001215" rel="noreferrer">Setting Up an App’s Associated Domains</a> for more information on associated domains.

Hard to guess the cause of the spike without knowing more about your product - but some possible causes:

<ul>
<li>you recently released an update to your iOS or macOS app</li>
<li>a larger customer just signed up for your service or rolled out your product to more employees</li>
<li>a larger customer just deployed an iOS or macOS operating system update to their managed devices</li>
</ul>

Anyway, I would ignore the spike. If it's causing you trouble, ensure your load balancer is configured correctly.

blocks|key|90333|text|最近我们的CDN和WAF检测到了同样的行为，我们在一些客户端检测到的是一个僵尸网络以分布式的方式对用户进行枚举，甚至还有一个名字，用户枚举喷雾。任何不知道网络攻击是如何工作的人都会说这是正常的。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|90334|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Recently this same behavior was detected by our CDN and our WAF's, and what we detected here in some clients, was a botnet doing enumeration of users in a distributed way, there is even a name for it, user enumeration spraying.
Anyone who doesn't know how web attacks work would say this is normal.

I've noticed in the AWS console that our website got a lot of more requests than normally. Especially in the night hours (Europe time).

<a href="https://i.stack.imgur.com/KInGY.png" rel="noreferrer"><img src="https://i.stack.imgur.com/KInGY.png" alt="enter image description here"></a>

Then I've checked the nginx logs and now I know that a lot of devices with different IP addresses request the root of the website, most of them with the user agent <code>swcd (unknown version) CFNetwork/978.0.7 Darwin/18.7.0</code>. Sometimes one of the versions is different.

I have absolutely no idea what is going on so I hope that someone can help.

Getting suddenly a lot of request from CFNetwork/Darwin

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

我在AWS控制台中注意到，我们的网站收到了比平时多得多的请求。特别是在夜间(欧洲时间)。​​然后我检查了nginx的日志，现在我知道很多不同IP地址的设备都会请求网站的根目录，其中大多数都使用用户代理swcd (unknown version) CFNetwork/978.0.7 Darwin/18.7.0。有时其中一...

问突然收到来自CFNetwork/Darwin的大量请求
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问突然收到来自CFNetwork/Darwin的大量请求EN