Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My web server is getting a lot of GET request on thinker/js/think.js and thinker/showSimilarInfo.do.

These requests obviously constitute a server attacks.

What is point of these attacks?

Also, is there a way to automatically ban IP which is trying to this kind of attack.

share|improve this question

What is point of these attacks?

There is probably an application out there that has a security vulnerability in one of these files. If you're not hosting these files you can probably ignore the request. It's probably someone scanning thousands of hosts to find one that is vulnerable.

Also, is there a way to automatically ban IP which is trying to this kind of attack.

Sure. fail2ban is a common solution for this sort of thing, but there are others. fail2ban monitors log files for certain patterns, and then executes actions when certain thresholds are reached. A typical action is to modify the local firewall configuration to ban the offending ip address.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.