0

I am currently looking at the logs of my server and it is currently targeted by an IP address in the Netherlands performing requests to routes such as /X.tar.gz, where they increment X from a to z and 0 to 9. The same happens without the gz extension.

I don't serve such content and all of these requests are actually responded to with 400/410, as they should. I am reasonably familiar with attacks coming in that try to exploit vulnerabilities in e.g. wordpress and other tools (so far none of them that I could see for the actual software used on the server), but this strikes me as a bit odd, because most attacks that I see either POST, or have query parameters.

What could the intention here be? Are they trying to scrape my data (how common could it possibly be to store just single character/digit tar files)? Is this some kind of botnet thinking that my server is their server? Something completely different?

Improve this question
5
  • 1
    Actually, you should respond with 404. 410 implies it used to be there, and now it's not anymore.
    – user163495
    Apr 19, 2021 at 13:26
  • It might be the standard name that some software uses to save data, so if such a file exists it might contain sensitive data and be downloaded by the attacker. Of course it's easy to guess why an attacker would look for backup.tar.gz, while I don't now what kind of process would generate a file named 1.tar.gz
    – reed
    Apr 19, 2021 at 13:27
  • @MechMK1 The IP address used to be used for domains which are still pointing to that IP, but aren't served by that anymore (the owners clearly didn't bother to delete DNS entries), so I defaulted to the rule "unexpected server name => 410". Sorry, I probably should have clarified that.
    – stefan
    Apr 19, 2021 at 13:28
  • It may also be that this data would have been served by the previous owner of the IP addresses. Or it may just be a mis-configured server (with a typo in the IP for example). If you want to play, you could try to serve an invalid 1.tar.gz and see what happens next.
    – Ljm Dullaart
    Apr 19, 2021 at 14:50
  • As long as there's no threat that I'm failing to see, I'm fine with this happening again. It wasn't huge amount of traffic.
    – stefan
    Apr 19, 2021 at 14:52

1 Answer 1

Reset to default
0

I doubt this is a targeted attack, similar to what most people said in the comments, this is a bot probing for tarballs created by a naive webmaster or archiving software. Don't pay these bots much attention as they likely scan the entire IPv4 space.

If you are still unsure if the attack was targeted, you can use IP reputation tools like Greynoise and AbuseIPDB to determine if the attack has been seen by others.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .