So, im a newbie here.
I have some services running.
I put today all behind Nginx as a reverse proxy. And im using ssl/tls from letsencrypt.
I found this ip in my access.log from Nginx.
83.97.73.87 - - [10/Nov/2023:12:20:35 -0300] "GET /_ignition/execute-solution HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
83.97.73.87 - - [10/Nov/2023:12:23:23 -0300] "GET / HTTP/1.1" 200 615 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
83.97.73.87 - - [10/Nov/2023:12:45:26 -0300] "GET / HTTP/1.1" 200 615 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
I look for that ip and it seems that is a BAD IP!!!
Look https://www.abuseipdb.com/check/83.97.73.87
Im fine or i need to do something to avoid this?!
Im safe or this could made something to my server?
This looks like a port scanning address, which is normal. Being scanned is just a fact of life if you host a service on the internet. What exactly was in your access log? Is it a connection on
/? Is it a 404 on a weird path? Is it accessing data on a service you run?Personally, I’d block the IP and move on, since 99 times in 100, its not too big of a deal since an automated scan won’t do much. If it is scanning services you actively run, it would warrant digging in deeper, reading all logs and bit more closely, but it is still not too likely it will result in an intrusion.