0

I have just recently set up a home web server as a sort of personal learning project. I noticed some strange access logs last night. There were about 12 HTTP requests from the ip address 87.148.246.162. The first one looked like:

87.148.246.162 - - [29/Nov/2017:07:09:55 -0800] "\xa8" 400 0 "-" "-"

Then there were two that looked like:

87.148.246.162 - - [29/Nov/2017:07:11:56 -0800] "POST / HTTP/1.1" 200 336 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; Creative AutoUpdate v1.41.09)"

and finally a bunch that looked like:

87.148.246.162 - - [29/Nov/2017:07:15:57 -0800] "POST / HTTP/1.1" 200 336 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"

There are a couple of things that concerned me about these connections. First, the website I have on the server right now is stupidly simply. It is just a boring html file. It doesn't even have any styling. Since it has zero interactivity, I don't know why they would be using POST.

Second, I used a ip geolocating site and it said that the ip address is located in Germany. Right now there are maybe like 10 people in the world who would have any reason to access my site, and all of them are in the U.S.

So, should I be concerned about these logs, or am I just being paranoid? If I should be concerned, what should I do about it?

Also, any beginner tips on things I can do to further secure my server would be much appreciated. Right now I configured my router to put the web server in a dmz, so hopefully it is isolated from everything else in my home network. I also set up a firewall to block all of the ports of the server except for those necessary for ssh and for serving web content.

1 Answer 1

0

It is very common to see 'scans' or bots to connect to any new even put online within minutes or even seconds. This is why it's important to secure all ports and accounts by default, before bringing the servers online.

Most bad guys will scan block of IPs and anything that replies they will probe for vulnerability. So fellow these practices and get ready for many more records in your logs like these

1
  • Is there any way to tell if they were actually successful in doing anything?
    – Kyle
    Nov 29, 2017 at 20:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.