Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My webserver logs revealed a request to /user/ from, which maps to Mumbai, India. The HTTP user agent is called 'Morpheus * Scanner'. My server returned a 404 error.

Obviously it is some kind of scanner, but I don't know any details. Is it searching for vulnerabilities? Does anyone have any information on this, and is it something to be worried about?

share|improve this question
Check out "Morfeus" scanners or "" scans. They target PHP based sites... – user53421 Aug 7 '14 at 8:10
up vote 7 down vote accepted

So the internet is a bad place. You have probably been scanned a thousand times before without noticing it, everyone has. There are bots that scan absolutely everyone for a handful of vulnerabilities in the chance of getting lucky.

Nothing special.

share|improve this answer

This hit a couple of my boxes over December 2012 and today.

Boxes get scanned all the time, what is interesting about this is why it is only requesting '/user/'. What is it looking for? (rhetorical question)

Also hit:

Nov 2008:

Dec 2011:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.