Looking at the server request logs for Machine Learning for Kids is a depressing reminder of what it means to run something on the Internet nowadays.
I was skimming through the request logs for the Machine Learning for Kids servers yesterday [1], and what jumped out at me was the constant rate of requests to non-existent paths that I just generate HTTP 404 responses for.
These aren’t someone accidentally mistyping a URL.
I grepped an excerpt from the log for requests that got an HTTP-404 response and put the result in a gist.
The result is an interesting reminder of the reality of the Internet nowadays.
Have a quick scroll at gist.github.com/dalelane – I think the URL and user-agent properties are probably the most interesting bits.
The requests that caught my eye first were just looking for credential files that I might’ve accidentally left on the server, such as /.ftpconfig, /backend/sftp-config.json, /sftp.json, /winscp.ini, /deploy.json, /.idea/deployment.xml.
But the more I looked, I started to see how thousands of requests were systematically trying permutations of prefixes for different platforms and frameworks combined with common names of credentials files.
A few examples of prefixes I recognised:
| path prefix | platform / framework |
|---|---|
/.aws/ |
AWS |
/.amplify/ |
AWS Amplify |
/laravel/ |
Laravel PHP framework |
/node_modules/ |
Node.js / React |
A few examples of credential files suffixes that keep coming up:
.env, .env.local, .env.prod, .env.production, .env.staging, .env.dev, .env.development, .env.test, .env.bak, .env.backup, .env.old, .env.save, .env.txt, .env.example, .env.dist, .env.aws, .env.s3, .env.ses, .env.sendgrid, web.config, .boto, .s3cfg, .dockercfg, credentials, credentials.csv, credentials.json, credentials.bak, rootkey.csv, accesskeys.csv, terraform.tfstate, terraform.tfstate.backup, aws-exports.js, aws-exports.json, awsconfiguration.json, amplify-meta.json, appsettings.json, appsettings.aws.json, appsettings.production.json, smtp_credentials.json, mailgun/mail_config.json, api/sendgrid_key.txt, api/secrets.sql, postgres_dump.sql, database.mongodump.zip, dump.sqlite, .kube/config.txt, cloudflare_api_key.txt, shopify/config.yml, truststore.p12, ssl/keystore.p12, tls.pem, id_ecdsa.pub
The thoroughness of it is kind of amazing.
There are hundreds of requests that assume it’s a WordPress server, with requests to paths starting with /wp-includes/, /wp-admin/, /wp-json/, /wp-content/.
At least one client seemed to be trying every known WordPress subdirectory path, but there are lots of requests looking for specific WordPress plugins such as /wp-content/plugins/gravitysmtp and /wp-content/plugins/revslider, presumably because these are plugins with known vulnerabilities?
Lots of requests were trying to find WordPress database credentials with requests to paths such as /wp-config.php.bak, /wp-config.php.backup and /wp-config.php.old.
Hundreds of requests were looking for admin panels and consoles, with requests to paths such as /admin, /administrator, /phpmyadmin/, /phpMyAdmin/, /PMA/, /pma/, /myadmin/, /mysql/, /mysqladmin/, /dbadmin/, /db/.
Some requests were looking for info about a git repository, with requests to paths such as /.git/HEAD and /.git/config.
In an interesting sign of the times, there are requests to paths like /mcp and /sse, presumably looking for unauthenticated Model Context Protocol servers they can exploit.
Speaking of AI, in addition to regular spiders and web crawlers, I also see requests from web crawlers for AI services, including PerplexityBot, OAI-SearchBot and Google-Extended.
I’m sure there are more patterns in the logs – as someone who runs a WordPress site, and has worked on React sites and Node.js and MCP servers, those were just the URLs that jumped out at me. I imagine that someone with a different tech background will recognise other things in there.
Moral of the story?
Firstly, a reminder that there are some bad actors on the Internet who spoil it for the rest of us.
Secondly… I need to set up some more firewall rules.
[1] – Why was I looking at the request logs?
There was a maintenance window this weekend for the IBM watsonx Assistant service that I use in Machine Learning for Kids for projects to recognise text. Existing models would’ve kept working, but for a few hours on Saturday morning students who tried to train a new model will have seen an “Unknown error” message.
I’ve improved this now so in future maintenance windows students will see a message explaining the reason, but I was curious to see how many students would’ve hit “Unknown error” before I fixed that, so I had a quick look through the request logs to see failed model training requests.
Tags: mlforkids-tech