0

This question already has an answer here:

We have a Node.js based web application, that has routes like:

myapp.com/posts/[postId]

We tracked strange requests, which lead to 404 on this routes. The requests were to routes like:

/posts/phpinfo.php
/posts/.user.ini
/posts/info.php3
/posts/phptest.php

Neither we're using PHP nor do i know anything about it...

To me it seems that a crawler/bot is requesting these routes, using some PHP related stuff as postIds which makes no sense (to me)...

Is this legit, though useless, or a security related issue?

What could cause this?

marked as duplicate by Steffen Ullrich, ISMSDEV, Community Aug 22 at 5:00

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

0

This is a classic case of an attacker scanning your website to look for any interesting directories or files that may lead to exploitation. I can say that this happens to a very high percentage of websites online.

The hacker is running a not so sophisticated directory scan and is using the .php extension by default.

As mentioned in the comments, this question may be able to give you additional information.

Not the answer you're looking for? Browse other questions tagged or ask your own question.