Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

My webserver logs revealed a request to /user/soapCaller.bs from 220.226.188.32, which maps to Mumbai, India. The HTTP user agent is called 'Morpheus * Scanner'. My server returned a 404 error.

Obviously it is some kind of scanner, but I don't know any details. Is it searching for vulnerabilities? Does anyone have any information on this, and is it something to be worried about?

share|improve this question

2 Answers 2

up vote 5 down vote accepted

So the internet is a bad place. You have probably been scanned a thousand times before without noticing it, everyone has. There are bots that scan absolutely everyone for a handful of vulnerabilities in the chance of getting lucky.

Nothing special.

share|improve this answer

This hit a couple of my boxes over December 2012 and today. http://pastie.org/5611554

Boxes get scanned all the time, what is interesting about this is why it is only requesting '/user/soapCaller.bs'. What is it looking for? (rhetorical question)

Also hit:

Nov 2008: http://www.rejetto.com/forum/hfs-~-http-file-server/did-anyone-know-anything-about-morfeus-fucking-scanner/

Dec 2011: http://serverfault.com/questions/337450/how-are-these-bad-bots-finding-my-closed-webserver

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.