Home / server / Questions / 220518
Accepted
aneuryzm
Asked: 2011-01-10 23:05:05 +0800 CST

Webserver logs: "Morfeus F***ing Scanner"

  • 772

I've just found these accesses in my web server log files:

::ffff:218.38.136.38 109.72.95.175 - [10/Jan/2011:02:54:12 +0100] "GET /user/soapCaller.bs HTTP/1.1" 404 345 "-" "Morfeus Fucking Scanner"
::ffff:218.38.136.38 109.72.95.174 - [10/Jan/2011:02:54:12 +0100] "GET /user/soapCaller.bs HTTP/1.1" 404 345 "-" "Morfeus Fucking Scanner"

Should I start to worry ? Or is it just a normal attempt to hack my server ? thanks

security web-server lighttpd

2 Answers

  1. Best Answer

    It's a scanner looking for vulnerabilities in PHP based websites(reference). Script kiddies use these types of things to scan many many websites. You're not necessarily being singled out.

    If you're not running PHP, you have nothing to worry about. If you are, I sure hope you're using secure code.

    • 8

  2. It's looking for vulnerabilities, and you can deny it access this way in your config: 

    $HTTP["useragent"] =~ "^Morfeus" { url.access-deny = ( "" ) }
    • 3