Linked Questions
17 questions linked to/from Strange requests to web server
1
vote
2
answers
1k
views
Apache Access Log Indicates DOS Attack? Or any other attack? [duplicate]
Below is my apache access log.
175.139.240.59 - - [28/Jul/2017:23:42:50 +0000] "HEAD http://xx.xxx.xx.xxx:80/mysql/admin/ HTTP/1.1" 301 -
...
175.139.240.59 - - [28/Jul/2017:23:42:50 +0000] "HEAD ...
- 11
0
votes
0
answers
407
views
Strange get request to my web server [duplicate]
I recently set up a python-bottle web server for a school project to essentially open my Garage Door remotely over the internet. Recently I saw the logs had a strange get request and was wondering if ...
0
votes
0
answers
342
views
Weird GET request on internet facing Nginx [duplicate]
I spun up an internet facing nginx server in AWS and the logs started showing weird get requests with a search engine's spider as user agent.
172.31.43.193 - - [19/Aug/2020:20:09:19 +0000] "GET /...
- 101
-1
votes
1
answer
245
views
Weird GET request to /proxychecker/check.cgi [duplicate]
I started running a flask application on a raspberry pi last night. It was not hiding behind apache or nginx, served the requests by itself. I set up my router to forward http traffic towards it as ...
- 3
2
votes
1
answer
264
views
php-fpm.log shows a mass of unusual attempts to open primary script with random filenames [duplicate]
I recently happened to inspect my php-fpm.log and found a lot of suspicious activity that looks like malicious attempts to get access to my host. Here're some of the logs:
[07-Oct-2018 22:01:31] ...
- 21
0
votes
1
answer
171
views
Why there are some weird requests to my web hosting [duplicate]
I was doing my plesk hosting logs checking for web and database development. Somehow, I had seen some weird ip trying to communicate to hosting. Wonder what is the purpose of these anonymous requests. ...
0
votes
1
answer
99
views
CentOS payload injection attempts? [duplicate]
My PHP logs have been flooding with seemingly random attempts to access scripts and software which isn't installed on my server. At first, All the attempts came from a single IP, I was using ...
0
votes
0
answers
34
views
What are these access requests? [duplicate]
So I have a series of these requests in my log and was wondering what they were? It appears malicious but no harm has been done. Can anyone confirm? - Any insight or reading material etc that would ...
- 1
0
votes
0
answers
6
views
Server directory bruteforcing [duplicate]
Recently I saw hundreds of strange requests from different ip addresses in my server logs.
These requests were trying to bruteforce directories for example:
GET /admin/admin.php 404
GET /admin/...
- 1
11
votes
3
answers
4k
views
Concerning GET request in logs
I have a Django application running on a Digital Ocean Ubuntu server. I am using NGINX and Daphne to serve the application because I am using Django Channels.
My websockets keep crashing, and I ...
- 213
4
votes
1
answer
2k
views
Visitors logs show \x80w\x01\x03\x01 the HNAP1
Can anyone tell me what this means? I'm on Bluehost with a shared server.
[ip]71.63.199.72 [url]HNAP1 [size] 134 [status] 401 [method]GET [protocol] HTTP/1.1 [referring url] My server address
[ip]71....
- 41
3
votes
2
answers
1k
views
Protecting server from bogus HTTP Requests
What would be the recommended approach to block those typical bogus
HTTP requests that the server gets bombarded with?
Also has this attack/nuisance been named yet or is it generalized as Bot Activity?...
- 458
1
vote
1
answer
2k
views
There seems to have been an attempt to attack my website [duplicate]
I am using PHP as a server side language. And I don't use CMS or Framework. From the nginx log the website attack seems obvious.
I wonder what kind of attack the attacker attempted.
The attacker ...
- 11
0
votes
2
answers
255
views
Too much requests on the Nginx Server [closed]
I'm receiving a lot of requests like these
[server] zcat access*gz | grep 404 | awk '{print $1" "$7}' | sort | uniq -c | less
:
2 103.193.242.137 /MCLi.php
1 103.193.242.137 /Moxin.PHP
...
- 101
1
vote
1
answer
138
views
Does it make sense to configure the web server to deny obviously malicious requests?
I have a Ruby on Rails app behind Nginx. Every once in a while I see requests like GET /phpmyadmin or GET /wp-login.php. Since I don't have those tools installed, it's obvious that those are from ...
- 113