I'm noticing scans in /var/log/apache of search engine bots GETing specific filenames from my server. Most of them are for cracks. I'm not hosting those files, and I don't see them anywhere on my disks. Any idea what would cause this?
They scan to know if you are at risk, thus to hack you later on if they can get their hand on those files.
It's often php config's file (with database password in it), wordpress's config file, etc..
Like on my server I see RDP's attempt too, welcome to the internet...
ps. Many use fail2ban to block those ip after in an automatic's manner.
Fail2ban scans log files (e.g. /var/log/apache/error_log) and bans IPs that show the malicious signs -- too many password failures, seeking for exploits