I'm running a webserver with monitoring software (Sentry.io) and I can see (failed) hits to the following endpoints:

GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
GET /console/
POST /api/jsonws/invoke
POST /mifs/.;/services/LogService
POST /Autodiscover/Autodiscover.xml
GET /_ignition/execute-solution
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php

To me, these are quite suspicious. For context the server is not a PHP server, it's NodeJS with all of its endpoints explicitly defined - it's not serving from the filesystem - and it's behind an nginx reverse proxy.

Should I be concerned about getting requests like this? I'm confident they aren't getting anywhere with their efforts, since I know what all of the endpoints are because I defined them.

I'm also thinking I might be overthinking things and they might be regular crawlers looking for common pages or something. Should I be concerned? And should I be attempting to block/counter these requests, or just let them happen and not get anywhere?

  • This is normal; it is what it means to connect a server to the Internet - you are inviting people to connect to services on your computer. Your server's authentication and authorization will handle the rest. The only real downside is the volume of network traffic they generate; and the volume of 404, 500, etc responses you have to generate. But, again, connecting a computer to the Internet means you want people to access it. – Ian Boyd Apr 11 at 4:09

This is perfectly normal internet background noise. As long as you keep your applications updated and endpoints known, there is no need to worry.

If you want to filter the traffic from entering your server at all, then you can use CloudFlare for example. They have a Web Application Firewall, which filters most common web scans.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.