网站MediaWiki页面遭重复WebSocket请求404错误，求排查思路

先梳理下你观测到的核心异常行为：

• 三个独立IP均先通过搜索成功访问了你的MediaWiki页面
• 两个IP出现规律性408超时错误，随后开始每秒重复发送WebSocket请求（你的网站未部署WebSocket服务）
• 单个IP在6小时内发送了2000次WebSocket请求，全部返回404；24小时内三个IP累计造成约5000次404错误
• 附带异常标识：一个IP出现Ajax Error CB，另一个显示Plugin:ABN
• 其中一个IP的初始流量来自Bing，User-Agent指向Windows 10+Edge浏览器

结合这些特征和Apache日志，成因基本可以锁定为浏览器或第三方插件的异常逻辑触发，而非针对性攻击，具体拆解如下：

1. 第三方插件的循环请求逻辑错误 #

从日志里的/82A2C3C3-09A7-A741-99A9-2EC607BE97FF/websocket这类非常规路径来看，这绝对不是正常用户或标准浏览器发起的请求——更像是某个浏览器插件（比如广告拦截工具、页面增强插件，甚至恶意插件）在尝试建立WebSocket连接时出现了逻辑bug。

因为你的网站根本没有WebSocket服务，请求返回404后，插件的错误处理机制失效，直接进入了无限循环请求的状态，这就是为什么会出现“每秒一次、持续6小时”的疯狂请求。

2. 规律性408错误的触发原因 #

日志里的空请求行（"-"）返回408，是因为插件在发起请求后，自身的超时机制出现异常，重复发送了没有请求内容的空请求，服务器等待超时后返回408。这种规律性的5分钟间隔，也符合插件内部的定时重试逻辑出错的特征。

3. Windows 10+Bing流量的关联点 #

那个来自Bing的IP使用的是Edge 18浏览器，Windows 10系统下的Edge可能预装了某些第三方插件，或者用户自行安装的插件在处理MediaWiki页面时出现兼容性问题——MediaWiki的页面结构和加载逻辑可能触发了插件的异常分支，导致后续的疯狂请求。

4. Ajax Error CB和Plugin:ABN的直接指向 #

Ajax Error CB是插件发起Ajax请求时的回调函数错误，Plugin:ABN大概率是某个插件的内部标识（比如广告拦截类插件的缩写），这两个标识直接坐实了“插件异常”的结论，排除了服务器自身或常规爬虫的问题。

相关Apache日志片段 #

Case 1 from 76.30.86.NNN - Comcast IP Address in US.
c-76-30-86-NNN.hsd1.tx.comcast.net - - [18/Sep/2019:10:20:22 -0700] "GET /support/kb/Repair/Re-install_Outlook_2003,_2007,_2010,_2013,_2016 HTTP/1.1" 200 10411 " https://www.bing.com/search?q=install+microsoft+outlook&FORM=QSRE4 " "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18362"
76.30.86.NNN - - [18/Sep/2019:10:25:24 -0700] "-" 408 137 "-" "-"
76.30.86.NNN - - [18/Sep/2019:10:30:25 -0700] "-" 408 3284 "-" "-"
76.30.86.NNN - - [18/Sep/2019:10:35:25 -0700] "-" 408 3284 "-" "-"
76.30.86.NNN - - [18/Sep/2019:10:40:25 -0700] "-" 408 3284 "-" "-"
76.30.86.NNN - - [18/Sep/2019:10:45:26 -0700] "-" 408 3284 "-" "-"
76.30.86.NNN - - [18/Sep/2019:10:50:26 -0700] "-" 408 3284 "-" "-"
76.30.86.NNN - - [18/Sep/2019:10:55:26 -0700] "-" 408 3284 "-" "-"
76.30.86.NNN - - [18/Sep/2019:11:00:27 -0700] "-" 408 3284 "-" "-"
76.30.86.NNN - - [18/Sep/2019:11:05:27 -0700] "-" 408 3284 "-" "-"
76.30.86.NNN - - [18/Sep/2019:11:10:27 -0700] "-" 408 3284 "-" "-"
76.30.86.NNN - - [18/Sep/2019:11:15:28 -0700] "-" 408 3284 "-" "-"
c-76-30-86-NNN.hsd1.tx.comcast.net - - [18/Sep/2019:11:15:28 -0700] "GET /82A2C3C3-09A7-A741-99A9-2EC607BE97FF/init?url=https%3A%2F%2Fwww.mywebsite.com%2Fsupport%2Fkb%2FRepair%2FRe-install_Outlook_2003%2C_2007%2C_2010%2C_2013%2C_2016&isTopLevel=true&nocache=14f0e HTTP/1.1" 301 4417 " https://www.mywebsite.com/support/kb/Repair/Re-install_Outlook_2003,_2007,_2010,_2013,_2016 " "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18362"
c-76-30-86-NNN.hsd1.tx.comcast.net - - [18/Sep/2019:11:15:28 -0700] "GET /82A2C3C3-09A7-A741-99A9-2EC607BE97FF/websocket?url=https%3A%2F%2Fwww.mywebsite.com%2Fsupport%2Fkb%2FRepair%2FRe-install_Outlook_2003%2C_2007%2C_2010%2C_2013%2C_2016&nocache=1568830527710 HTTP/1.1" 301 4336 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18362"
snip - repeats approx every second for 2040 times
c-76-30-86-NNN.hsd1.tx.comcast.net - - [18/Sep/2019:17:15:57 -0700] "GET /82A2C3C3-09A7-A741-99A9-2EC607BE97FF/init/?url=https%3A%2F%2Fwww.mywebsite.com%2Fsupport%2Fkb%2FRepair%2FRe-install_Outlook_2003%2C_2007%2C_2010%2C_2013%2C_2016&isTopLevel=true&nocache=10fec HTTP/1.1" 404 55891 " https://www.mywebsite.com/support/kb/Repair/Re-install_Outlook_2003,_2007,_2010,_2013,_2016 " "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18362"
c-76-30-86-NNN.hsd1.tx.comcast.net - - [18/Sep/2019:17:15:57 -0700] "GET /82A2C3C3-09A7-A741-99A9-2EC607BE97FF/init?url=https%3A%2F%2Fwww.mywebsite.com%2Fsupport%2Fkb%2FRepair%2FRe-install_Outlook_2003%2C_2007%2C_2010%2C_2013%2C_2016&isTopLevel=true&nocache=10fec HTTP/1.1" 301 4417 " https://www.mywebsite.com/support/kb/Repair/Re-install_Outlook_2003,_2007,_2010,_2013,_2016 " "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18362"
c-76-30-86-NNN.hsd1.tx.comcast.net - - [18/Sep/2019:18:48:27 -0700] "GET /support/kb/Repair/Re-install_Outlook_2003,_2007,_2010,_2013,_2016 HTTP/1.1" 200 10412 " https://www.bing.com/search?q=install+microsoft+outlook&FORM=QSRE4 " "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18362"
c-76-30-86-NNN.hsd1.tx.comcast.net - - [18/Sep/2019:19:44:52 -0700] "GET /support/kb/Repair/Re-install_Outlook_2003,_2007,_2010,_2013,_2016 HTTP/1.1" 200 10413 " https://www.bing.com/search?q=install+microsoft+outlook&FORM=QSRE4 " "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.18362"

内容的提问来源于stack exchange，提问作者user35546