57

I have a Linode VPS running Nginx, which currently serves only static content.

Once I was looking at the log and noticed some strange requests:

XXX.193.171.202 - - [07/Aug/2013:14:04:36 +0400] "GET /user/soapCaller.bs HTTP/1.1" 404 142 "-" "Morfeus Fucking Scanner"
XXX.125.148.79 - - [07/Aug/2013:20:53:35 +0400] "GET /phpmyadmin/scripts/setup.php HTTP/1.1" 404 142 "-" "ZmEu"
XXX.125.148.79 - - [07/Aug/2013:20:53:35 +0400] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 142 "-" "ZmEu"
XXX.125.148.79 - - [07/Aug/2013:20:53:35 +0400] "GET /myadmin/scripts/setup.php HTTP/1.1" 404 142 "-" "ZmEu"
XXX.125.148.79 - - [07/Aug/2013:20:53:35 +0400] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 142 "-" "ZmEu"
XXX.125.148.79 - - [07/Aug/2013:20:53:35 +0400] "GET /pma/scripts/setup.php HTTP/1.1" 404 142 "-" "ZmEu"
XXX.125.148.79 - - [07/Aug/2013:20:53:35 +0400] "GET /MyAdmin/scripts/setup.php HTTP/1.1" 404 142 "-" "ZmEu"
XXX.221.207.157 - - [07/Aug/2013:22:04:20 +0400] "\x80w\x01\x03\x01\x00N\x00\x00\x00 \x00\x009\x00\x008\x00\x005\x00\x00\x16\x00\x00\x13\x00\x00" 400 172 "-" "-"
XXX.221.207.157 - admin [07/Aug/2013:22:04:21 +0400] "GET /HNAP1/ HTTP/1.1" 404 142 "http://212.71.249.8/" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-us) AppleWebKit/xxx.x (KHTML like Gecko) Safari/12x.x"

Should I worry about somebody trying to hack my server in this case?

Improve this question
1
  • 5
    The HNAP request is an attempt to take advantage of an old d-link security flaw shown HERE
    – user38331
    Commented Feb 2, 2014 at 0:33

4 Answers 4

Reset to default
72

It appears that your server is the target of an automated attack involving the ZmEu scanner.

That first request appears to be from another automated attack involving the Morfeus Scanner.

That last request appears to be an attempt to exploit vulnerabilities in the Home Network Administration Protocol (HNAP) implementations of D-Link routers. More information about the attack can be found here.

From a cusory glance at the request it's making, I'd say you have nothing to worry about if you aren't running phpmyadmin on your systems. Such attacks are commonplace for servers connected to the internet and the scans are getting 404's indicating that your server does not have what they are looking for.

Improve this answer
4
  • 1
    Thank you. Can you comment on first and last two requests? Seems they're not part of ZmEu attack.
    – Michael Pankov
    Commented Aug 8, 2013 at 17:28
  • @Constantius That first request appears to be another automated scanner hitting a HTTP 404. Nothing to worry about there. I can't tell what the second last request appears to be doing, but the last request appears to be an attempt to exploit a vulnerability in Dlink routers. I will update my answer.
    – user10211
    Commented Aug 9, 2013 at 3:12
  • The second to last is probably an HTTPS connection attempt.
    – deed02392
    Commented Feb 17, 2014 at 16:31
  • In 2014, the HNAP was succesfully exploited by The Moon worm. isc.sans.edu/forums/diary/…
    – Palec
    Commented May 14, 2016 at 10:29
33

Every server that is connected to the Internet will receive hundreds of "weird requests". Most of them are from automatic botnets which try to replicate, by finding machines which feature a specific vulnerability. They try random IP addresses (there are only four billions of possible IP addresses, after all). So yes, someone is trying to enter into your server, but that "someone" is a mindless automaton who has nothing against you, specifically.

I would say that if you find the log entries, then the attack did not work so you don't have to worry about them. When the attack is successful, the first thing the attacker does is to remove its traces from log files.

This does highlight the utmost necessity of installing security fixes, because every online server is, by construction, exposed and will be targeted by such random attacks at some point.

Improve this answer
2
  • 4
    Your point about the first thing an attacker might do is erase the traces of entry is very enlightening! We channel our logs out to another server, so hopefully if something were to happen we will have a record. :)
    – Dustin Graham
    Commented Oct 9, 2013 at 15:29
  • I have question, is there a service that I can redirect these attackers to these services so they will be identified. I'm getting the same requests to my ip address, but my domain has Cloudflare should I redirect them to the Cloudflare domain? So I can block them.
    – siniradam
    Commented Dec 16, 2019 at 7:15
11

if you want to block known scanners you might want to use nginx-based WAF naxsi + doxi-rules; these scanners are widely known

doxi + naxsi in action

Improve this answer
-1

According to the latest report the Vulnerability is in ZynOS and is trouble for the users of the router from the D-Link, TP-Link, ZTE and other manufacturers which allow remote hackers in changing the DNS settings and hijacks the user traffic. This vulnerability has a "backdoor-type" function "built" into the router suggests a deliberate implementation.

  1. The input of the “ping” tool that D-Link DIR636L incorrectly filters allows the injection of the arbitrary commands into the router
  2. This enables the remote attacker that gains the full control of the router, for example that attacks the network in the DDoS style attack or even the exposure of computers behind the devices to internet that changes firewall/NAT rules on the routers
Improve this answer
1
  • 1
    I'm not sure this applies to the OP. Can you specify why this D-Link vulnerability applies?
    – schroeder ♦
    Commented Mar 25, 2015 at 7:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .