So, I was hosting my website on fastapi, and then I saw this 2 requests on my server. random malicious requests I found that there was link, that was linking to file named "shk" on random ip adresses. I tried to download this on my VM and I got this:

enter image description here.

Does someone know what is going on? I think some people trying to infect servers with their backdoor or smth else viruses. If you know anything about that, please comment this.

1 Answer 1


This is an attempt to exploit CVE-2023-1389, which is a vulnerability in the web interface of some routers. For details about these exploits see for example Active Exploitation Attempts (CVE-2023-1389) Against TP-Link Archer Gigabit Internet Routers.

I was hosting my website on fastapi, ...

You can ignore this as (to you) harmless internet noise, since your web site is (very likely) not affected by this security issue.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .