Dear Azure IP address,

[stefano@mastodon.bsd.cafe]

Dear Azure IP address,

please stop requesting a.php and other php files. The Mastodon BSD Cafe domain won't serve them, you're just wasting power and polluting the planet.

Thank you,
Stefano

[mms@mastodon.bsd.cafe]

@stefano that's exactly what someone using a.php to serve secrets would say.

[indyradio@kafeneio.social]

@stefano I've seen this stupid crap. wtf! really.

[stefano@mastodon.bsd.cafe]

@mms of course 😆

[liebach@mastodon.art]

@stefano For a long while I've added IP's requesting *.php files (along with a bunch of other suspicious things) to a pf table I block.

[release_candidate@mastodon.bsd.cafe]

@stefano I bet they are requesting .env and .conf too.

[hbauer@social.caserio.de]

@stefano i have a rule for crowdsec and block everybody requesting php on my static blog

[overeducatedredneck@bitbang.social]

@indyradio @stefano it's a vulnerability scanner. There's a lot of broken php out there, and someone is looking for low hanging fruit. If you don't run php, putting a fail2ban rule in for requests for php files is a pretty reasonable thing to do. It's on my todo list.

[indyradio@kafeneio.social]

@overeducatedredneck @stefano
I hate that. I also have some ancient php running behind a reverse proxy. The dickheads try to abrogate the proxy. They are not scanning the internet as a favor to you, as you well know.

[overeducatedredneck@bitbang.social]

@indyradio @stefano They're usually looking for a few different products: old wordpress, old phpmyadmin and a few other things. If there's one or more you don't use, add those paths to trigger the autoblock.

And yeah, as someone who does defensive infosec, they aren't trying to make the world a better place.

[indyradio@kafeneio.social]

@overeducatedredneck @stefano I should do that, I've been doing it manually.

[stefano@mastodon.bsd.cafe]

@release_candidate they are!