0

I've read bits around this, but I am curious should I be worried. I constantly am getting hit with random GET and POST requests from I guess just bots crawling the web trying to find vulnerabilities.

You can see below, the POST /GponForm/diag is one, the GET /client/get_targets basically everything that isn't GET /highscores in that screenshot, is from some random server somewhere pinging random endpoints.

Is there anything I can do or should be worried about? My server setup is basically a IIS reverse proxying a nodejs application. But I'm unsure what to do. I initially had another smaller server infront of this server as a proxy and then configured this server to only accept requests from the proxy server but i'm trying to cut costs since it's just a side project so don't want a lot of servers running with lots of requests going through.

Any advice? Is it just okay to leave as is? Or should I configure or do something about it.

Thank you!

enter image description here

0

1 Answer 1

0

When you run a publicly accessible server, it's perfectly normal to get probe requests. There' nothing inherently dangerous about that. In fact, the requests you've shown don't look targeted at all, so this is likely just a mass scan to find servers which respond with something other than 404.

From a security perspective, there's no need to do anything. At best, you could configure your reverse proxy to only forward requests which should actually be processed by your node.js application. That is, you could create a whitelist of valid endpoints and make the reverse proxy immediately reject all other paths with a 404 error. This will keep the node.js logs clean and might act as a safeguard in case you've forgotten sensitive data anywhere in the document root or the web application.

Not the answer you're looking for? Browse other questions tagged .