Web scanning and probing of Linux servers
An address requesting paths that exist only on other software: administration panels, backup files, environment files, known exploit paths. One address asking for dozens of them in a row is a scanner working through a list, and the agent blocked it.
The observatory is not answering just now. The numbers are rebuilt every hour; try again shortly.
What a block for this reason means
An address requesting paths that exist only on other software: administration panels, backup files, environment files, known exploit paths. One address asking for dozens of them in a row is a scanner working through a list, and the agent blocked it.
Why it happens to every server
Scanners are looking for a known hole, not for this site. A request for a path that was never there is harmless on its own; what it tells you is that the address will try every other path on its list, and that a server with one of those holes would be found within hours of going online.
What to do about it
Nothing installed that is not used; no backup or environment files inside a web root; software kept current, because the list the scanner carries is a list of old versions. The free assessment checks for known web shells and for packages with known vulnerabilities.
How to read these figures
- Blocks, not attempts. An attack SecAI did not block is not counted, so these are floors.
- A small fleet. A handful of servers. The number of servers is next to every figure because it is part of what the figure means.
- No addresses, countries or ports. The address is used to count distinct sources and then dropped; the rest is not recorded on a block.
How this data is collected and what is left out · All categories
Also published: SSH password guessing, WordPress abuse, Floods and connection exhaustion.
Free to reuse with credit (CC BY 4.0). Cite as: SecAI Threat Observatory, Web scanning and probing, https://secai.techsteps.ae/threats/web-scanning. The same counts are in the JSON at https://secai.techsteps.ae/api/public/threats, rebuilt hourly.
Questions
Not enough of it on the servers SecAI monitors to publish a figure: a category is published only once it has been seen on several servers with enough events to be anonymous.
One block: an address the agent blocked on a customer's server for this reason, and confirmed it had blocked. Distinct addresses are counted separately, because one address can be blocked many times.
No. The published tables hold counts by day and category. The attacker's address is used to count distinct sources and then discarded; no customer address, hostname or server identifier is stored or served, and a day or category seen on too few servers is withheld.
Is your server in this already?
The free assessment reads how your server is set up and tells you what an attacker would find, in about a minute, without changing anything.