This question already has an answer here:
I have set up an Apache/2.2.22 (Debian) Server on my Rasberry Pi. Looking at my access.log, I see a bit of strange activity consisting mostly of GETs, which is quite disconcerting as I am a complete newbie in such matters. The strangest thing was a series of POSTs consisting of percentage signs and numbers. I know next to nothing about web technologies, but I assumed they were escaped HTML characters. Decoding the characters of one of them (there were 2 varieties) from "POST php-cgi?" forwards, it resulted in the following:
"POST /cgi-bin/php-cgi?-d+allow_url_include=on+-d+safe_mode=off+-d+suhosin.simulation=on-d+disable_functions=""+-d+open_basedir=none+-d+auto_ prepend_file=php://input+-d+ cgi.force_redirect=0+-d+cgi. redirect_status_env=0+-n"
And a sample GET:
"GET /HNAP1/ HTTP/1.1"
What is going on here? Are bots randomly testing IP addresses for vulnerabilities? Should I be worried?
Edit: these requests returned 404.