I have a small VPS running nginx, and for a long time now (several months, since I rented it) it has been collecting weird entries in its default (listen 80 default;) vhost's logs:

109.x.x.121 - - [07/Dec/2012:07:42:43 +0100] "GET /webpanel/gate.php HTTP/1.1" 404 168 "-" "WICKED"

there is a lot of those, from a few different IPs

# grep WICKED /var/log/nginx/x.access.log | awk '{print $1}' | sort | uniq | wc -l

There are also recurring ones, like this one which polls the server every minute

95.x.x.4 - - [07/Dec/2012:08:17:35 +0100] "-" 400 0 "-" "-"
95.x.x.4 - - [07/Dec/2012:08:18:37 +0100] "-" 400 0 "-" "-"
95.x.x.4 - - [07/Dec/2012:08:19:39 +0100] "-" 400 0 "-" "-"

until it stops. According to its PTR and whois information, this particular IP belongs to a dynip range of some German cable company so it's probably not a monitoring service.

Now, here's my question, what am I looking at?

Was the IP being used in some sort of bot herding before I got it? Or maybe my server was compromised? Those entries were showing up when I only had sshd and nginx serving static sites so pretty much nothing to exploit.

EDIT: yeah, I inflated the numbers unwittingly because I forgot to sort, fixed.

  • We must perform an exorcism to cleanse these WICKED NUMBERS! – Lucas Kauffman Dec 7 '12 at 21:03

The last two fields by default are the referrer and user agent fields (nginx reference). Normally you'd see something there like a browser (Mozilla), search bot (Googlebot), command line program ("Wget", "curl") etc. there. Whoever is running something against your server is using "WICKED" as a user agent string.

  • And I'd also point out that this means nothing specific. Just someone decided to call their program "WICKED"; that's really all you can conclude directly. – tylerl Dec 7 '12 at 23:42
  • Yup, could be custom-made, could be a regular browser with a custom user agent. No telling. – Jeff Ferland Dec 7 '12 at 23:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.