I've just found these accesses in my web server log files:

::ffff: - [10/Jan/2011:02:54:12 +0100] "GET /user/soapCaller.bs HTTP/1.1" 404 345 "-" "Morfeus Fucking Scanner"
::ffff: - [10/Jan/2011:02:54:12 +0100] "GET /user/soapCaller.bs HTTP/1.1" 404 345 "-" "Morfeus Fucking Scanner"

Should I start to worry ? Or is it just a normal attempt to hack my server ? thanks

2 Answers 2


It's a scanner looking for vulnerabilities in PHP based websites(reference). Script kiddies use these types of things to scan many many websites. You're not necessarily being singled out.

If you're not running PHP, you have nothing to worry about. If you are, I sure hope you're using secure code.

  • can you expand on what this scanner actually does? We seem to have been penetrated by it and I need to find out what to do next. We're sending out a lot of spam at present....
    – Mazatec
    Jun 20, 2011 at 7:28

It's looking for vulnerabilities, and you can deny it access this way in your config:

$HTTP["useragent"] =~ "^Morfeus" { url.access-deny = ( "" ) }
  • 1
    Unless it modifies it's useragent
    – Plimpus
    Oct 31, 2012 at 12:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.