I have just recently set up a home web server as a sort of personal learning project. I noticed some strange access logs last night. There were about 12 HTTP requests from the ip address 87.148.246.162. The first one looked like:
87.148.246.162 - - [29/Nov/2017:07:09:55 -0800] "\xa8" 400 0 "-" "-"
Then there were two that looked like:
87.148.246.162 - - [29/Nov/2017:07:11:56 -0800] "POST / HTTP/1.1" 200 336 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; Creative AutoUpdate v1.41.09)"
and finally a bunch that looked like:
87.148.246.162 - - [29/Nov/2017:07:15:57 -0800] "POST / HTTP/1.1" 200 336 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko"
There are a couple of things that concerned me about these connections. First, the website I have on the server right now is stupidly simply. It is just a boring html file. It doesn't even have any styling. Since it has zero interactivity, I don't know why they would be using POST.
Second, I used a ip geolocating site and it said that the ip address is located in Germany. Right now there are maybe like 10 people in the world who would have any reason to access my site, and all of them are in the U.S.
So, should I be concerned about these logs, or am I just being paranoid? If I should be concerned, what should I do about it?
Also, any beginner tips on things I can do to further secure my server would be much appreciated. Right now I configured my router to put the web server in a dmz, so hopefully it is isolated from everything else in my home network. I also set up a firewall to block all of the ports of the server except for those necessary for ssh and for serving web content.
