0

Request log example 1

Request log example

I was doing my plesk hosting logs checking for web and database development. Somehow, I had seen some weird ip trying to communicate to hosting. Wonder what is the purpose of these anonymous requests. Should I just ignore them as they are common issue happening around?

Thanks in advance. P/S: This website still in development stage, should be no one knowing this website address.

Wayne Zack
  • 1
  • 1
  • Maybe related in this forum - https://www.symantec.com/connect/forums/definition-network-scan-threats-muieblackcat – Alex Probert Jan 13 '20 at 13:19
  • 1
    *"This website still in development stage, should be no one knowing this website address."* - there is no need to actually "know" the website. In most cases it is sufficient to just scan a range of IP addresses and then try various requests. – Steffen Ullrich Jan 13 '20 at 14:50
  • @SteffenUllrich Alright, thank you for this! – Wayne Zack Jan 13 '20 at 19:09

1 Answers1

0

I'm not going to say "ignore them entirely", but this is pretty common.

They're automated scans for logins - basically, anyone and their dog/cat/cow/python/rat can scan a site for common login URLs. If the scan finds them, then they'll usually probably try following up with credential stuffing attacks (i.e. using username/password combos that are either known defaults such as admin/admin or come from a data breach).

The best way to prevent those from succeeding is to not use weak username/passwords (using a password manager - nothing else is really practical), and enable two-factor authentication if Plesk allows that.

Philip Rowlands
  • 1,779
  • 1
  • 13
  • 27