Bonjour à tous.
Je dispose d'un serveur dédié chez Hetzner depuis peu.
Il est maintenant up et presque terminé. La sécurité est en place en grande partie (rkhunter, porsentry, fail2ban, site full https), il me reste juste le firewall.
Je surveille les logs régulièrement et j'ai remarqué de nombreuses requête GET sur mes logs *access.log de nginx sui commencent par "GET /www/delivery/ajs.php
en voici quelques unes :
37.212.78.215 - - [02/May/2016:14:28:29 +0200] "GET /www/delivery/ajs.php?zoneid=2&cb=51487293761&charset=UTF-8&loc=http%3A//myfin.by/bank/belarusbank/vklady&referer=http%3A//myfin.by/bank/belarusbank/vklady/1401-klassik-bezotzyvnyyi-do-goda HTTP/1.1" 403 189 "http://myfin.by/bank/belarusbank/vklady" "Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.110 Safari/537.36 OPR/36.0.2130.65 (Edition Campaign 34)"
80.94.166.66 - - [02/May/2016:14:28:40 +0200] "GET /www/delivery/ajs.php?zoneid=2&cb=29213481070&charset=UTF-8&loc=http%3A//myfin.by/bank/belarusbank/vklady&referer=http%3A//www.yandex.by/clck/jsredir%3Ffrom%3Dwww.yandex.by%253Byandsearch%253Bweb%253B%253B%26text%3D%26etext%3D1042.i0Gj8Grnx3CAfa92E277i-Wiuy63nm0h9Eiwqt3Yje_xMgGm0b2XShbwAz7UepCN6XggJN_HebRBETb5P3wXbtavU751DFK0_dWAYwtaeL7fhXNe9sqpZeS_6XpInrAmglGlcpIIIAqzoCMQ_m1XJywK3c0ZG-ZQav4xc4dvuqU.3ebbd53657d78ba1cb3877532a7269842cee0fad%26uuid%3D%26state%3DPEtFfuTeVD5kpHnK9lio9T6U0-imFY5IWwl6BSUGTYnrZ_xNWq0QNJI_7tB8xYKggS7lQYait_Q%26data%3DUlNrNmk5WktYejR0eWJFYk1Ldmtxbl9YSWVzU1cyVXhYbWQ1eVhDT1pTb0JfX0FubGFWZk8xczlmXzdobTNhZW51S2IzbmhwUFp1aDhxZnBobWdLdGY1Z3BfaXVNN09QeTdvQm9OMTV5YXRYS0lhN0E0RlNqTTBtZUE1dHhfaVM%26b64e%3D2%26sign%3D3808ffb5ebe45e53890c30daf06ca68d%26keyno%3D0%26cst%3DAiuY0DBWFJ5Hyx_fyvalFA81e1KQsyBBSsqImNMV9JATN8QRP2n_1Q2bRt9415r3GQgjxgiYWIyhzZmQLyZCAFSx1W4W2tT0yj_eiwGrqcDnsBRN6o6Vv6W6v3kVOfx9fqZ6Dt0sdSAs08FnjafNgxH-jRIXMrRQtscGho4aR8mqa151HRWJ5O9VJLIv_S62UxblLu17qDy-otWdH8DmwI-9TSa4XyrL3EhfcPI5dJuHMakDgx3wtGL_-rp-fhnUU2gsX6Wv0HO1cXQLH9MWnPw23FIaeSD-LbH3AvKCo8V9dOOAYLDXuab0jx5NrN7KY6mvyC9UNjwo__oZARi_sbih2lg9BZAZ4VD3JmgLPqY%26ref%3DorjY4mGPRjlSKyJlbRuxUktv92klnDKHbzjnJ3NB5ZvBsTba1u_N5bea3co2O2QEpqFCurCPIyfcksGolgYLV4fquGiGeE33HD_mPKJW9XrQHbsV7gRbN9-yAA8sK8vD2zuCvje1us8aaVl0RRN8KKDW__sAVVPdFEORvFn4b46ihb6IfYPJqqcdJvYFRxCj-zpLGu6PM1QhzZ3FpEW7f4LMMmZ57l7e5GJCEzAQcLUx-lSrDIF3IzXYuZ5O9KAeMJWcGeGPvoqBqNhzwgC-5JQ4a89WX1R3cWCVkBKYGpUBVhKwP1JVdB2DMCpkYqLj3HcLlb8psytZGjql9dVUVOAc_Z4TPV7KLRC51PCbCbO7CCuZUpvSeHjp4l94KdZldBcmGL-FZCGBvj0M-BcI-T3twcPqZZ0cQfIr4QvE7E6cYjpKEhHC6BQehIJIp2tVg9zqlLZ6MVW7mKld9eBdPhudfhAUQZyKoBJ4xClo-zMB6cmPM30gr5LTYEeW_k2AoY-A78QMZMY%26l10n%3Dru%26cts%3D1462192344034%26mc%3D5.191882244240422 HTTP/1.1" 403 189 "http://myfin.by/bank/belarusbank/vklady" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/35.0.1916.153 Safari/537.36 OPR/22.0.1471.70"
178.120.58.89 - - [02/May/2016:14:31:13 +0200] "GET /www/delivery/ajs.php?zoneid=2&cb=86032652058&charset=UTF-8&loc=http%3A//m.myfin.by/bank/belarusbank/vklady&referer=https%3A//www.google.by/ HTTP/1.1" 403 189 "http://m.myfin.by/bank/belarusbank/vklady" "Mozilla/5.0 (Linux; Android 5.0.1; MX5 Build/LRX22C) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36"
178.120.253.103 - - [02/May/2016:14:32:14 +0200] "GET /www/delivery/ajs.php?zoneid=2&cb=58104783230&charset=utf-8&loc=http%3A//myfin.by/bank/belarusbank/vklady&referer=http%3A//go.mail.ru/search%3Frf%3D10445%26fm%3D1%26gp%3Dcustom2%26us%3D11%26usln%3D7%26usstr%3D%25D0%25B1%25D0%25B5%25D0%25BB%25D0%25B0%25D1%2580%25D1%2583%25D1%2581%25D0%25B1%25D0%25B0%25D0%25BD%25D0%25BA%26usqid%3Dc9d23157fcf9a508%26hasnavig%3D0%26q%3D%25D0%25B1%25D0%25B5%25D0%25BB%25D0%25B0%25D1%2580%25D1%2583%25D1%2581%25D0%25B1%25D0%25B0%25D0%25BD%25D0%25BA%2520%25D0%25B2%25D0%25BA%25D0%25BB%25D0%25B0%25D0%25B4%25D1%258B HTTP/1.1" 403 162 "http://myfin.by/bank/belarusbank/vklady" "Opera/9.80 (Windows NT 5.1; MRA 6.3 (build 8050)) Presto/2.12.388 Version/12.16"
Savez-vous comment empêcher ceci ? Sachant qu'il n'y a pas dans mon webroot de delivery/ajs.php de toute façon.
Merci d'avance
