0

While reading our logs I came across several requests that seems to be scanning for vulnerabilities on our web app.

2021-09-25T17:32:44.164858+00:00 app[web.1]: 54.39.216.121 - - [25/Sep/2021:17:32:44 +0000] "GET /wp-includes/js/jquery/jquery-migrate.min.js HTTP/1.1" 404 136 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
2021-09-25T17:32:44.385438+00:00 app[web.1]: 54.39.216.121 - - [25/Sep/2021:17:32:44 +0000] "GET /wp-includes/ID3/license.txt HTTP/1.1" 404 136 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
2021-09-25T17:32:44.899962+00:00 heroku[router]: at=info method=GET path="/" fwd="54.39.216.121,172.70.110.92" dyno=web.1 connect=1ms service=273ms status=200 bytes=179371 protocol=https
2021-09-25T17:32:45.150180+00:00 heroku[router]: at=info method=GET path="/xmlrpc.php" fwd="54.39.216.121,172.70.110.66" dyno=web.1 connect=0ms service=2ms status=302 bytes=219 protocol=https
2021-09-25T17:32:45.182297+00:00 app[web.1]: 54.39.216.121 - - [25/Sep/2021:17:32:45 +0000] "GET /about/xmlrpc.php HTTP/1.1" 404 136 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"

I looked up the ip address 54.39.216.121 but I'm not sure what to make of it. The URLs returns JSON.

Do I write an email to abuse@ovh.ca? And what do I write?

whois 54.39.216.121
NetRange:       54.39.0.0 - 54.39.255.255
CIDR:           54.39.0.0/16
NetName:        HO-2
NetHandle:      NET-54-39-0-0-1
Parent:         NET54 (NET-54-0-0-0-0)
NetType:        Direct Allocation
OriginAS:       
Organization:   OVH Hosting, Inc. (HO-2)
RegDate:        2017-10-16
Updated:        2017-10-16
Ref:            https://rdap.arin.net/registry/ip/54.39.0.0

OrgName:        OVH Hosting, Inc.
OrgId:          HO-2
Address:        800-1801 McGill College
City:           Montreal
StateProv:      QC
PostalCode:     H3A 2N4
Country:        CA
RegDate:        2011-06-22
Updated:        2017-01-28
Ref:            https://rdap.arin.net/registry/entity/HO-2


OrgAbuseHandle: ABUSE3956-ARIN
OrgAbuseName:   Abuse
OrgAbusePhone:  +1-855-684-5463
OrgAbuseEmail:  abuse@ovh.ca
OrgAbuseRef:    https://rdap.arin.net/registry/entity/ABUSE3956-ARIN


OrgTechHandle: NOC11876-ARIN
OrgTechName:   NOC
OrgTechPhone:  +1-855-684-5463
OrgTechEmail:  noc@ovh.net
OrgTechRef:    https://rdap.arin.net/registry/entity/NOC11876-ARIN


NetRange:       54.39.216.112 - 54.39.216.127
CIDR:           54.39.216.112/28
NetName:        OVH-CUST-13387652
NetHandle:      NET-54-39-216-112-1
Parent:         HO-2 (NET-54-39-0-0-1)
NetType:        Reassigned
OriginAS:       AS16276
Customer:       StarkVPS (C07465115)
RegDate:        2019-12-01
Updated:        2019-12-01
Ref:            https://rdap.arin.net/registry/ip/54.39.216.112


CustName:       StarkVPS
Address:        Kiefernkamp 1
City:           Norderstedt
StateProv:

PostalCode:     22844
Country:        DE
RegDate:        2019-12-01
Updated:        2019-12-01
Ref:            https://rdap.arin.net/registry/entity/C07465115


OrgAbuseHandle: ABUSE3956-ARIN
OrgAbuseName:   Abuse
OrgAbusePhone:  +1-855-684-5463
OrgAbuseEmail:  abuse@ovh.ca
OrgAbuseRef:    https://rdap.arin.net/registry/entity/ABUSE3956-ARIN


OrgTechHandle: NOC11876-ARIN
OrgTechName:   NOC
OrgTechPhone:  +1-855-684-5463
OrgTechEmail:  noc@ovh.net
OrgTechRef:    https://rdap.arin.net/registry/entity/NOC11876-ARIN
dotnetCarpenter
  • 133
  • 1
  • 5
  • 4
    Any publicly accessible server will see thousands of these daily. It's not worth the reporting effort; ignore and continue on with life. – ceejayoz Sep 25 '21 at 18:30
  • I would contact OVH. The mini allocation looks dodgy. There are people/companies out there that fraudulently carve out allocations from existing netblocks. Not saying that is what happened here. – Greg Askew Sep 25 '21 at 20:46
  • Since the majority advice for letting it go, I think that is what I'll do. Would be interesting to collect those requests with IP address and whois object at the time, for educational purpose. @GregAskew I'm not sure what to write to OVH. You sold 15 IP addresses and they are probing our hosted web server? – dotnetCarpenter Sep 27 '21 at 10:25

0 Answers0