路由器的日志,是被攻击了吗?

Mapley

有电信的公网,看了一下路由器日志,如下,请大佬帮忙分析一下:
[DHCP IP: (10.0.0.4)] to MAC address 8C:DE:F9:94:60:48, Sunday, May 25,2025 23:29:02
[Admin login] from source 10.0.0.2, Sunday, May 25,2025 23:27:52
[UPnP set event: Public_UPNP_C3] from source 10.0.0.2, Sunday, May 25,2025 23:20:38
[UPnP set event: Public_UPNP_C3] from source 10.0.0.2, Sunday, May 25,2025 23:20:05
[DHCP IP: (10.0.0.16)] to MAC address 40:D1:60:D1:C1:02, Sunday, May 25,2025 23:07:51
[DHCP IP: (10.0.0.16)] to MAC address 40:D1:60:D1:C1:02, Sunday, May 25,2025 23:07:33
[DHCP IP: (10.0.0.16)] to MAC address 40:D1:60:D1:C1:02, Sunday, May 25,2025 23:05:58
[DHCP IP: (10.0.0.16)] to MAC address 40:D1:60:D1:C1:02, Sunday, May 25,2025 23:05:22
[DHCP IP: (10.0.0.16)] to MAC address 40:D1:60:D1:C1:02, Sunday, May 25,2025 23:04:49
[DHCP IP: (10.0.0.16)] to MAC address 40:D1:60:D1:C1:02, Sunday, May 25,2025 23:03:28
[DHCP IP: (10.0.0.15)] to MAC address 5C:C3:36:9C:AA:1C, Sunday, May 25,2025 23:03:25
[Admin login] from source 10.0.0.2, Sunday, May 25,2025 22:58:19
[DHCP IP: (10.0.0.17)] to MAC address 78:11:DC:E7:FA:E9, Sunday, May 25,2025 22:50:49
[Admin login] from source 10.0.0.2, Sunday, May 25,2025 22:31:06
[Admin login] from source 10.0.0.2, Sunday, May 25,2025 22:19:58
[UPnP set event: Public_UPNP_C3] from source 10.0.0.3, Sunday, May 25,2025 22:18:59
[UPnP set event: Public_UPNP_C3] from source 10.0.0.3, Sunday, May 25,2025 21:55:58
[UPnP set event: Public_UPNP_C3] from source 10.0.0.3, Sunday, May 25,2025 21:49:48
[UPnP set event: Public_UPNP_C5] from source 10.0.0.16, Sunday, May 25,2025 18:10:37
[LAN access from remote] from 110.189.217.58:5293 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:10
[LAN access from remote] from 27.226.52.74:33201 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:10
[LAN access from remote] from 183.19.253.37:29548 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:09
[LAN access from remote] from 117.61.108.72:8403 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:08
[LAN access from remote] from 113.103.235.179:54723 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:08
[LAN access from remote] from 116.27.183.2:15161 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:08
[LAN access from remote] from 113.100.244.61:5830 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:08
[LAN access from remote] from 14.110.82.80:24640 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:08
[LAN access from remote] from 116.252.163.30:51872 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:08
[LAN access from remote] from 110.187.172.238:13573 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:08
[LAN access from remote] from 118.248.43.119:9043 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:08
[LAN access from remote] from 123.174.79.221:45994 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:08
[LAN access from remote] from 171.81.185.155:14527 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:08
[LAN access from remote] from 49.70.26.85:9720 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:08
[LAN access from remote] from 114.221.19.238:13207 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:08
[LAN access from remote] from 124.79.78.138:44602 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:08
[LAN access from remote] from 223.240.246.160:53092 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:08
[LAN access from remote] from 106.113.34.18:29098 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:08
[LAN access from remote] from 101.83.121.219:45988 to 10.0.0.16:8765, Sunday, May 25,2025 18:10:08
[LAN access from remote] from 36.143.244.78:3479 to 10.0.0.16:8765, Sunday, May 25,2025 18:09:58
[UPnP set event: Public_UPNP_C5] from source 10.0.0.16, Sunday, May 25,2025 18:09:55
[LAN access from remote] from 115.152.10.240:27873 to 10.0.0.13:8568, Sunday, May 25,2025 18:06:53
[LAN access from remote] from 114.107.176.9:30794 to 10.0.0.13:8568, Sunday, May 25,2025 18:06:53
[LAN access from remote] from 60.189.217.175:7854 to 10.0.0.13:8568, Sunday, May 25,2025 18:06:52
[LAN access from remote] from 49.75.46.24:60088 to 10.0.0.13:8568, Sunday, May 25,2025 18:06:52
[LAN access from remote] from 117.81.164.16:8520 to 10.0.0.13:8568, Sunday, May 25,2025 18:06:47
[LAN access from remote] from 49.75.42.110:62812 to 10.0.0.13:8568, Sunday, May 25,2025 18:06:46
[DHCP IP: (10.0.0.5)] to MAC address 24:59:E5:93:71:D0, Sunday, May 25,2025 18:06:16
[LAN access from remote] from 49.84.90.255:14628 to 10.0.0.13:8568, Sunday, May 25,2025 18:05:34
[LAN access from remote] from 222.93.144.34:3314 to 10.0.0.13:8568, Sunday, May 25,2025 18:05:33
[LAN access from remote] from 114.216.68.48:11228 to 10.0.0.13:8568, Sunday, May 25,2025 18:05:33
[LAN access from remote] from 49.75.42.227:39086 to 10.0.0.13:8568, Sunday, May 25,2025 18:05:33
[LAN access from remote] from 49.75.42.228:8527 to 10.0.0.13:8568, Sunday, May 25,2025 18:05:33
[LAN access from remote] from 222.93.144.31:36037 to 10.0.0.13:8568, Sunday, May 25,2025 18:05:33
[LAN access from remote] from 222.93.144.26:24546 to 10.0.0.13:8568, Sunday, May 25,2025 18:05:33
[LAN access from remote] from 218.2.227.166:14098 to 10.0.0.13:8568, Sunday, May 25,2025 18:05:22
[LAN access from remote] from 114.239.140.170:54313 to 10.0.0.13:8568, Sunday, May 25,2025 18:05:21
[LAN access from remote] from 121.239.176.226:11959 to 10.0.0.13:8568, Sunday, May 25,2025 18:05:21
[LAN access from remote] from 60.27.95.178:3748 to 10.0.0.13:8568, Sunday, May 25,2025 18:03:46
[LAN access from remote] from 119.102.99.84:1026 to 10.0.0.13:8568, Sunday, May 25,2025 18:03:41
[LAN access from remote] from 111.174.126.139:8441 to 10.0.0.13:8568, Sunday, May 25,2025 18:03:41
[LAN access from remote] from 171.81.193.226:14481 to 10.0.0.13:8568, Sunday, May 25,2025 18:03:41
[LAN access from remote] from 116.128.253.163:9058 to 10.0.0.13:8568, Sunday, May 25,2025 18:03:35
[LAN access from remote] from 112.48.10.0:59502 to 10.0.0.13:8568, Sunday, May 25,2025 18:03:34
[LAN access from remote] from 223.77.106.251:8704 to 10.0.0.13:8568, Sunday, May 25,2025 18:03:34
[LAN access from remote] from 27.198.243.210:38912 to 10.0.0.13:8568, Sunday, May 25,2025 18:03:34
[LAN access from remote] from 39.64.57.127:9234 to 10.0.0.13:8568, Sunday, May 25,2025 18:03:34
[LAN access from remote] from 180.125.99.207:20818 to 10.0.0.13:8568, Sunday, May 25,2025 18:03:29
[LAN access from remote] from 58.213.253.1:10462 to 10.0.0.13:8568, Sunday, May 25,2025 18:03:29
[LAN access from remote] from 114.234.116.101:29158 to 10.0.0.13:8568, Sunday, May 25,2025 18:03:29
[LAN access from remote] from 121.235.96.69:1352 to 10.0.0.13:8568, Sunday, May 25,2025 18:03:29
[LAN access from remote] from 122.14.236.182:3479 to 10.0.0.13:8568, Sunday, May 25,2025 17:46:00
[UPnP set event: Public_UPNP_C5] from source 10.0.0.13, Sunday, May 25,2025 17:45:56
[LAN access from remote] from 183.212.154.253:28209 to 10.0.0.13:8568, Sunday, May 25,2025 17:28:23
[LAN access from remote] from 183.212.153.195:35504 to 10.0.0.13:8568, Sunday, May 25,2025 17:28:23
[LAN access from remote] from 116.115.0.13:23552 to 10.0.0.13:8568, Sunday, May 25,2025 17:16:30
[LAN access from remote] from 112.235.170.105:8961 to 10.0.0.13:8568, Sunday, May 25,2025 17:16:30
[LAN access from remote] from 124.164.202.54:8601 to 10.0.0.13:8568, Sunday, May 25,2025 17:16:18
[LAN access from remote] from 112.21.237.210:29071 to 10.0.0.13:8568, Sunday, May 25,2025 17:16:06
[DHCP IP: (10.0.0.15)] to MAC address 5C:C3:36:9C:AA:1C, Sunday, May 25,2025 17:15:50
[DHCP IP: (10.0.0.16)] to MAC address 40:D1:60:D1:C1:02, Sunday, May 25,2025 17:15:41
[LAN access from remote] from 122.14.236.182:3479 to 10.0.0.13:8568, Sunday, May 25,2025 17:14:33
[UPnP set event: Public_UPNP_C5] from source 10.0.0.13, Sunday, May 25,2025 17:14:31
[LAN access from remote] from 36.143.244.78:3479 to 10.0.0.13:8567, Sunday, May 25,2025 17:14:31
[UPnP set event: Public_UPNP_C5] from source 10.0.0.13, Sunday, May 25,2025 17:14:30
[LAN access from remote] from 112.235.170.105:8961 to 10.0.0.13:8568, Sunday, May 25,2025 17:08:35
[LAN access from remote] from 116.115.0.13:23552 to 10.0.0.13:8568, Sunday, May 25,2025 17:08:34
[LAN access from remote] from 124.164.202.54:8601 to 10.0.0.13:8568, Sunday, May 25,2025 17:08:22
[LAN access from remote] from 122.195.112.132:12009 to 10.0.0.13:8568, Sunday, May 25,2025 17:08:20
[LAN access from remote] from 112.21.237.93:21073 to 10.0.0.13:8568, Sunday, May 25,2025 17:07:46
[LAN access from remote] from 112.21.237.210:29143 to 10.0.0.13:8568, Sunday, May 25,2025 17:07:46
[LAN access from remote] from 183.212.153.195:34980 to 10.0.0.13:8568, Sunday, May 25,2025 17:07:46
[LAN access from remote] from 183.212.154.253:28208 to 10.0.0.13:8568, Sunday, May 25,2025 17:07:46
[LAN access from remote] from 124.164.202.54:8601 to 10.0.0.13:8568, Sunday, May 25,2025 16:51:58
[LAN access from remote] from 112.235.170.105:8961 to 10.0.0.13:8568, Sunday, May 25,2025 16:51:43
[LAN access from remote] from 112.21.237.210:22909 to 10.0.0.13:8568, Sunday, May 25,2025 16:51:10
[LAN access from remote] from 183.212.154.253:5085 to 10.0.0.13:8568, Sunday, May 25,2025 16:51:10
[LAN access from remote] from 183.212.153.195:35384 to 10.0.0.13:8568, Sunday, May 25,2025 16:51:10
[LAN access from remote] from 122.14.236.182:3479 to 10.0.0.13:8568, Sunday, May 25,2025 16:41:16
[UPnP set event: Public_UPNP_C5] from source 10.0.0.13, Sunday, May 25,2025 16:41:14
[DHCP IP: (10.0.0.11)] to MAC address 20:50:E7:5B:05:6C, Sunday, May 25,2025 16:37:19
[UPnP set event: Public_UPNP_C5] from source 10.0.0.13, Sunday, May 25,2025 16:06:06
[DHCP IP: (10.0.0.13)] to MAC address E4:B2:FB:0A:F1:24, Sunday, May 25,2025 16:05:42
[UPnP set event: Public_UPNP_C5] from source 10.0.0.13, Sunday, May 25,2025 16:02:20
[Admin login] from source 10.0.0.2, Sunday, May 25,2025 15:52:31
[Admin login] from source 10.0.0.2, Sunday, May 25,2025 15:35:32
[Log Cleared] Sunday, May 25,2025 15:27:52

yy7601190

根据您提供的路由器日志，确实存在一些可疑活动，可能表明您的路由器受到了攻击或尝试攻击。以下是一些关键点：

频繁的远程访问尝试：
多个外部IP地址尝试访问您的内部网络（例如，[LAN access from remote] from 110.189.217.58:5293 to 10.0.0.16:8765）。这些尝试可能表明有人在尝试扫描或攻击您的网络。
频繁的UPnP事件：
多次记录了UPnP事件（例如，[UPnP set event: Public_UPNP_C3] from source 10.0.0.2）。这些事件可能表明有人正在尝试配置您的路由器以开放不必要的端口。
频繁的DHCP分配：
多次记录了DHCP IP分配（例如，[DHCP IP: (10.0.0.16)] to MAC address 40:D1:60:D1:C1:02）。这些频繁的分配可能表明有人在尝试连接到您的网络。
频繁的管理员登录尝试：
多次记录了管理员登录尝试（例如，[Admin login] from source 10.0.0.2）。这些尝试可能表明有人在尝试破解您的路由器管理密码。
建议措施
更改路由器管理员密码：
使用强密码，并定期更改。
禁用UPnP：
如果您不需要UPnP功能，建议禁用它以减少攻击面。
更新路由器固件：
确保您的路由器固件是最新的，以修复已知的安全漏洞。
启用防火墙：
确保路由器的防火墙功能已启用，并配置适当的规则以阻止不必要的访问。
监控网络流量：
使用网络监控工具来检测和记录任何可疑活动。
限制远程访问：
如果不需要远程访问路由器管理界面，请禁用此功能。
检查连接设备：
定期检查连接到您网络的设备，确保没有未授权的设备。
联系网络服务提供商：
如果问题持续存在，可能需要联系您的网络服务提供商以获取进一步的帮助。
通过采取这些措施，您可以大大提高网络的安全性，并减少被攻击的风险。

chengzi223

检查路由器管理员密码是否安全，是否需要修改。
关闭不必要的 UPnP 功能，只在需要时开启
查看局域网内设备列表，确认所有设备都是信任的，检查是否有未知设备。
启用路由器的防火墙功能，限制外部对内部端口的访问，只允许必要的端口。

kexiao8

不好意思，抱着学习态度进来看的

gugouo163

看样子是UPnP自动映射了内网的端口出去，然后公网就一直有人在请求你内网的机器

xingyuanbao

你10.0.0.2是什么设备？看着都是从这台设备登录的，是不是你自己登录的？

oxxo119

不要自己吓自己，也许就是给设备联网而已

xiaoshu1688

10.0.0.2这个IP的电脑要查一下。

feelin

登录路由器后台，关闭 UPnP 功能，防止自动开启端口映射。
更改管理员密码，设置强密码，避免弱口令被暴力破解。
检查已经对外开放的端口，手动关闭不需要的端口。
10.0.0.13 和 10.0.0.16，可能已中毒或运行某种服务器程序。

andyle

关键你自己的网络，或者电脑有什么问题，看这日志无非是有远程连接而已，是不是你自己搞的