My webserver logs revealed a request to /user/soapCaller.bs from, which maps to Mumbai, India. The HTTP user agent is called 'Morpheus * Scanner'. My server returned a 404 error.

Obviously it is some kind of scanner, but I don't know any details. Is it searching for vulnerabilities? Does anyone have any information on this, and is it something to be worried about?

  • Check out "Morfeus" scanners or "soapCaller.bs" scans. They target PHP based sites...
    – user53421
    Aug 7 '14 at 8:10

So the internet is a bad place. You have probably been scanned a thousand times before without noticing it, everyone has. There are bots that scan absolutely everyone for a handful of vulnerabilities in the chance of getting lucky.

Nothing special.


This hit a couple of my boxes over December 2012 and today. http://pastie.org/5611554

Boxes get scanned all the time, what is interesting about this is why it is only requesting '/user/soapCaller.bs'. What is it looking for? (rhetorical question)

Also hit:

Nov 2008: http://www.rejetto.com/forum/hfs-~-http-file-server/did-anyone-know-anything-about-morfeus-fucking-scanner/

Dec 2011: https://serverfault.com/questions/337450/how-are-these-bad-bots-finding-my-closed-webserver

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.