3

I have a small VPS running nginx, and for a long time now (several months, since I rented it) it has been collecting weird entries in its default (listen 80 default;) vhost's logs:

109.x.x.121 - - [07/Dec/2012:07:42:43 +0100] "GET /webpanel/gate.php HTTP/1.1" 404 168 "-" "WICKED"

there is a lot of those, from a few different IPs

# grep WICKED /var/log/nginx/x.access.log | awk '{print $1}' | sort | uniq | wc -l
18

There are also recurring ones, like this one which polls the server every minute

95.x.x.4 - - [07/Dec/2012:08:17:35 +0100] "-" 400 0 "-" "-"
95.x.x.4 - - [07/Dec/2012:08:18:37 +0100] "-" 400 0 "-" "-"
95.x.x.4 - - [07/Dec/2012:08:19:39 +0100] "-" 400 0 "-" "-"

until it stops. According to its PTR and whois information, this particular IP belongs to a dynip range of some German cable company so it's probably not a monitoring service.

Now, here's my question, what am I looking at?

Was the IP being used in some sort of bot herding before I got it? Or maybe my server was compromised? Those entries were showing up when I only had sshd and nginx serving static sites so pretty much nothing to exploit.

EDIT: yeah, I inflated the numbers unwittingly because I forgot to sort, fixed.

1
  • We must perform an exorcism to cleanse these WICKED NUMBERS! Dec 7, 2012 at 21:03

1 Answer 1

2

The last two fields by default are the referrer and user agent fields (nginx reference). Normally you'd see something there like a browser (Mozilla), search bot (Googlebot), command line program ("Wget", "curl") etc. there. Whoever is running something against your server is using "WICKED" as a user agent string.

2
  • And I'd also point out that this means nothing specific. Just someone decided to call their program "WICKED"; that's really all you can conclude directly.
    – tylerl
    Dec 7, 2012 at 23:42
  • Yup, could be custom-made, could be a regular browser with a custom user agent. No telling.
    – Jeff Ferland
    Dec 7, 2012 at 23:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .