“WICKED” entries in the default nginx vhost's logs

Question

I have a small VPS running nginx, and for a long time now (several months, since I rented it) it has been collecting weird entries in its default (listen 80 default;) vhost's logs:

109.x.x.121 - - [07/Dec/2012:07:42:43 +0100] "GET /webpanel/gate.php HTTP/1.1" 404 168 "-" "WICKED"

there is a lot of those, from a few different IPs

# grep WICKED /var/log/nginx/x.access.log | awk '{print $1}' | sort | uniq | wc -l
18

There are also recurring ones, like this one which polls the server every minute

95.x.x.4 - - [07/Dec/2012:08:17:35 +0100] "-" 400 0 "-" "-"
95.x.x.4 - - [07/Dec/2012:08:18:37 +0100] "-" 400 0 "-" "-"
95.x.x.4 - - [07/Dec/2012:08:19:39 +0100] "-" 400 0 "-" "-"

until it stops. According to its PTR and whois information, this particular IP belongs to a dynip range of some German cable company so it's probably not a monitoring service.

Now, here's my question, what am I looking at?

Was the IP being used in some sort of bot herding before I got it? Or maybe my server was compromised? Those entries were showing up when I only had sshd and nginx serving static sites so pretty much nothing to exploit.

EDIT: yeah, I inflated the numbers unwittingly because I forgot to sort, fixed.

Answer 1

The last two fields by default are the referrer and user agent fields (nginx reference). Normally you'd see something there like a browser (Mozilla), search bot (Googlebot), command line program ("Wget", "curl") etc. there. Whoever is running something against your server is using "WICKED" as a user agent string.