Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a personal server located in the US, I use it to execute code which requires a lot of resources. I sometimes have apache running on my server, to test php code. I recently left my apache server running overnight, and the next morning I decided to check which ip addresses where connected to my server. To my surprise, I saw a bunch of ip addresses connected via http. Now I have my apache running so only certain ip addresses are allowed to see my directories. Everyone else would get 'forbidden' error, so that's not a problem. So I looked up these ip addresses that were connected to my server, some where from china, malaysia, and other asian countries, one of the ip addresses was google. So I googled my ip address and it was listed in many databases online.

Should I be concerened about this, and talk to my server provider to switch Ip address? Also, are there some bots online that just connect to random servers and sniff open ports or something? is this normal?

share|improve this question
4  
If I had a server online that didn't have all the daemon logs filled with bot spam, I'd assume there was something wrong with the network connectivity. –  lynks Dec 4 '12 at 10:02
    
I believe that your code blocking unknown IP addresses is not implemented correctly. ;( –  Mark C. Wallace Dec 4 '12 at 12:23
    
security.stackexchange.com/questions/16057/… - an open web proxy is a much more lucrative resource than an open SMTP relay. –  symcbean Dec 4 '12 at 16:45
add comment

2 Answers

up vote 6 down vote accepted

This is totally normal. There are thousands of bots on the internet that have the sole purpose of scanning every single IP address and attempting to infect it. Any information they discover will be put into a database somewhere, and there's nothing you can do about it. If you change your IP then that one will be discovered too unless you enable a firewall like ipchains on *nix and block all but known IPs, which is what you should be doing unless you need the internet to have access to your system.

Also, make sure your system and all the software on it is kept up to date. Be pathological about that as most attacks use well-known and patched vulnerabilities.

share|improve this answer
add comment

There are only four billions or so possible IP addresses, and a large proportion of them has been allocated (the IPcalypse is nigh !). This means that trying random addresses will hit a lot of servers.

A lot of virus/bots use this strategy to replicate; they just try randomly, to locate vulnerable targets by pure luck. And it works !

There are also non-malicious systems who try random addresses, namely search engines. A search engine builds its internal database of Web pages by following links from page to page, but it has to start somewhere. They normally begin with domain names (for each existing domain name like example.com, they use the DNS to know whether example.com or www.example.com resolves to an IP address, and, in that case, send HTTP requests over port 80, just in case) but some also try random IP addresses.

Occasionally, some academics also run surveys of Internet usage by sampling random IP addresses and see what kind of server responds (if any).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.