So, im a newbie here.
I have some services running.
I put today all behind Nginx as a reverse proxy. And im using ssl/tls from letsencrypt.
I found this ip in my access.log from Nginx.
83.97.73.87 - - [10/Nov/2023:12:20:35 -0300] "GET /_ignition/execute-solution HTTP/1.1" 404 555 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
83.97.73.87 - - [10/Nov/2023:12:23:23 -0300] "GET / HTTP/1.1" 200 615 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
83.97.73.87 - - [10/Nov/2023:12:45:26 -0300] "GET / HTTP/1.1" 200 615 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
I look for that ip and it seems that is a BAD IP!!!
Look https://www.abuseipdb.com/check/83.97.73.87
Im fine or i need to do something to avoid this?!
Im safe or this could made something to my server?
Normal background noise. You expose stuff to the public and in return you make friends with a bunch of bots.
lol, thanks.
Welcome to the Internet. Check out Crowdsec and WAFs
This looks like a port scanning address, which is normal. Being scanned is just a fact of life if you host a service on the internet. What exactly was in your access log? Is it a connection on
/? Is it a 404 on a weird path? Is it accessing data on a service you run?Personally, I’d block the IP and move on, since 99 times in 100, its not too big of a deal since an automated scan won’t do much. If it is scanning services you actively run, it would warrant digging in deeper, reading all logs and bit more closely, but it is still not too likely it will result in an intrusion.