Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a small VPS running nginx, and for a long time now (several months, since I rented it) it has been collecting weird entries in its default (listen 80 default;) vhost's logs:

109.x.x.121 - - [07/Dec/2012:07:42:43 +0100] "GET /webpanel/gate.php HTTP/1.1" 404 168 "-" "WICKED"

there is a lot of those, from a few different IPs

# grep WICKED /var/log/nginx/x.access.log | awk '{print $1}' | sort | uniq | wc -l
18

There are also recurring ones, like this one which polls the server every minute

95.x.x.4 - - [07/Dec/2012:08:17:35 +0100] "-" 400 0 "-" "-"
95.x.x.4 - - [07/Dec/2012:08:18:37 +0100] "-" 400 0 "-" "-"
95.x.x.4 - - [07/Dec/2012:08:19:39 +0100] "-" 400 0 "-" "-"

until it stops. According to its PTR and whois information, this particular IP belongs to a dynip range of some German cable company so it's probably not a monitoring service.

Now, here's my question, what am I looking at?

Was the IP being used in some sort of bot herding before I got it? Or maybe my server was compromised? Those entries were showing up when I only had sshd and nginx serving static sites so pretty much nothing to exploit.

EDIT: yeah, I inflated the numbers unwittingly because I forgot to sort, fixed.

share|improve this question
    
We must perform an exorcism to cleanse these WICKED NUMBERS! –  Lucas Kauffman Dec 7 '12 at 21:03

1 Answer 1

The last two fields by default are the referrer and user agent fields (nginx reference). Normally you'd see something there like a browser (Mozilla), search bot (Googlebot), command line program ("Wget", "curl") etc. there. Whoever is running something against your server is using "WICKED" as a user agent string.

share|improve this answer
    
And I'd also point out that this means nothing specific. Just someone decided to call their program "WICKED"; that's really all you can conclude directly. –  tylerl Dec 7 '12 at 23:42
    
Yup, could be custom-made, could be a regular browser with a custom user agent. No telling. –  Jeff Ferland Dec 7 '12 at 23:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.