1

I built a web application with low traffic so far, after making some advertising I realized there are some suspicious requests against my server, this is what Loggly service shows me in panel:

Logs from Loggly about nginx requests

I am not an expert in security information buy I'm suspecting that someone wants to attack my site or are preparing a future attack.

  • What does these logs mean exactly?
  • Should I worry too much about this behavior?
  • are they using some exploit scanner software ?

I am setting a web application firewall to add some rules to DNS and changing all admin passwords but what other recommendation I must keep in mind ? thanks in advanced

Improve this question

1 Answer 1

Reset to default
1

The Internet is a hostile place for servers.

As soon as you open a service expect it to be scanned by automated bots of all kinds: some will try to find a vulnerability, some will try hundreds of passwords, etc. These are automated bots who scan the web as a whole, they do not mean that you are or will be the victim of a targeted attack.

In you screenshot, not only the rule severity is flagged as "Informational" but also the requested URL do not exist on your server ("status 404"), so there is nothing worry here.

Use this however as warning to check that you apply updates regularly, use secure passwords and read about how to harden your server configuration. All these bots are just looking for low-hanging fruits so, as long as you follow IT-security good-practices you should have no worry with them.

Improve this answer
1
  • thanks, that information will help me to take action on the matter, I had already thought about Cloudflare and protection tools, I am going to take a look at right now
    – user8322093
    Jul 18, 2017 at 22:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .