Help Center/ Content Delivery Network/ Best Practices/ Analyzing Malicious Access Addresses Through Logs
Updated on 2026-04-22 GMT+08:00
View PDF
Share

Analyzing Malicious Access Addresses Through Logs

Scenario

If your domain name is attacked, you can analyze logs generated during the attack period to help you harden security configurations, such as referer validation and IP address access control lists (ACLs).

CDN logs contain user access information. An example of CDN logs is as follows: 
[05/Feb/2018:07:54:52 +0800] x.x.x.x 1 "-" "HTTP/1.1" "GET" "www.test.com" "/test/1234.apk" 206 720 HIT "Mozilla/5.0 (Linux; U; Android 6.0; zh-cn; EVA-AL10 Build/HUAWEIEVA-AL10) AppleWebKit/533.1 (KHTML, like Gecko) Mobile Safari/533.1" "bytes=-256" x.x.x.x

Table 1 describes each field (from left to right) in the log.

Table 1 Fields in CDN logs

No.

Description

Example

1

Log generation time

[05/Feb/2018:07:54:52 +0800]

2

Access IP address

x.x.x.x

3

Time to last byte (ms)

1

4

Referer information

-

5

HTTP protocol identifier

HTTP/1.1

6

HTTP request method

GET

7

Acceleration domain name

www.test.com

8

Request path

/test/1234.apk

9

HTTP status code

206

10

Response size (bytes)

720

11

Cache hit status

HIT

12

User-Agent information, which helps servers recognize the OS, OS version, CPU, browser, and browser's version information

Mozilla/5.0 (Linux; U; Android 6.0; en-us; EVA-AL10 Build/HUAWEIEVA-AL10) AppleWebKit/533.1 (KHTML, like Gecko) Mobile Safari/533.1

13

Range information, which specifies the positions of the first and last bytes for the data to be returned.

bytes can be expressed by the following three methods:

  • bytes=x-y: requesting content from the xth to yth byte.
  • bytes=-y: requesting content from the last y bytes.
  • bytes=x-: requesting content from the xth to the last byte.

bytes=-256

14

Server IP address: IP address of the CDN server that sends the response.

x.x.x.x

Procedure

  1. Log in to the CDN console.
  2. In the navigation pane, choose Logs.
  3. Select the acceleration domain name and specify the time range for the query.
  4. Click Download in the row of the desired log to download the log file to a local computer.
  5. Decompress the downloaded log file. To analyze multiple log files, combine them in Windows. 
    copy *.com-cn  hebing.txt
  6. Upload the log file to a local Linux server. You can then analyze:
    • Resources accessed by users: If the requested resources are centralized and visitor IP addresses are scattered, new resources may be added.

      Identify the top 100 most requested URLs.

      awk '{print $9}' hebing.txt | sort -n |uniq -c | sort -nr| head -n 100
    • Visitor IP addresses: If most requests are initiated by some IP address segments, the access traffic is heavy, and some URLs are mostly accessed, these visitor IP addresses may be malicious. In this case, you can add these IP addresses to the blacklist. For details, see IP ACL.
      Lists the top most active 100 IP addresses. 
      awk '{print $3}' hebing.txt | sort -n |uniq -c | sort -nr| head -n 100

      awk '{print $3}': Extracts the third column of the log file (where columns are space-separated), which represents the visitor IP addresses.

      hebing.txt: indicates the name of the combined log file. If you are analyzing a single log file, replace it with the specific log file name.

      sort -n: Sorts the IP addresses.

      sort -nr: Sorts the IP addresses in descending order.

      uniq -c: Counts the occurrences of each IP address.

      head -n 100: Extracts the top 100 most active IP addresses.

    • User-Agent information: Check whether uncommon or empty User-Agent headers exist to determine whether requests are attacks. If they are attacks, configure a User-Agent ACL.

      Identify the top 10 most frequent User-Agent strings.

      grep -o 'Mozilla[^"]*' hebing.txt | sort -n | uniq -c | sort -nr | head -n 10

      Exclude common User-Agent strings.

      grep -o 'Mozilla[^"]*' hebing.txt|grep -v -E "Firefox|Chrome|Safari|Edge"

      Count requests with empty User-Agent headers.

      awk '!/Mozilla/' hebing.txt | wc -l

      grep -o: prints only the matched content.

      grep -v -E: excludes the matched lines.

      wc -l: counts the number of lines.

    • Status codes: Identify malicious traffic by analyzing abnormal status codes in the logs. A high volume of error codes (4xx or 5xx) originating from a single IP may indicate an ongoing attack.
      Identify the top 10 most frequent status codes. 
      awk '{print $10}' hebing.txt | sort -n | uniq -c | sort -nr| head -n 10
    • You can also use other fields, such as referer and cache hit status, or combine multiple fields, to identify common attack patterns and harden your security configurations.