We have a Node.js based web application, that has routes like:


We tracked strange requests, which lead to 404 on this routes. The requests were to routes like:


Neither we're using PHP nor do i know anything about it...

To me it seems that a crawler/bot is requesting these routes, using some PHP related stuff as postIds which makes no sense (to me)...

Is this legit, though useless, or a security related issue?

What could cause this?


This is a classic case of an attacker scanning your website to look for any interesting directories or files that may lead to exploitation. I can say that this happens to a very high percentage of websites online.

The hacker is running a not so sophisticated directory scan and is using the .php extension by default.

As mentioned in the comments, this question may be able to give you additional information.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.