Web scanner probes: the odd requests in your access log
Within hours of going online, every web server starts receiving requests for files and apps it never had:
/.env, /.git/config,
eval-stdin.php, router and camera endpoints. These pages say what each probe is
after, which vulnerability it targets (from NVD and CISA's Known Exploited Vulnerabilities catalog), how to tell
whether you are exposed, and the nginx rule that answers it.
The counts are real: LogTriage's production API server (Hetzner, Germany): port 22 open to the internet, key-only since 6 October 2026 (password and keyboard-interactive authentication off); nginx in front of the API on ports 80 and 443. In the 30 days to 18 October 2026 it received 51,392 requests nobody asked for, from 3,208 addresses.
All probes, most frequent first
| Request | What it is after | Our server, 30 days | Triage |
|---|---|---|---|
| /.env | An automated scan for application .env files, which hold database passwords, API keys and other secrets in plain text whenever the web server hands one back. | 13,471 | medium |
| /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php CVE-2017-9841 · KEV | An automated probe for a leftover PHPUnit test-runner file under an exposed /vendor folder, which on unpatched versions turns POST data into PHP code the server executes. | 2,729 | medium |
| /.git/config | An automated check for a .git directory left inside the web root, which hands a scanner the repository's configuration, its history and ultimately the application's source code and committed secrets. | 1,343 | medium |
| /phpinfo.php | An automated hunt for a page that calls PHP's phpinfo() function, which prints the server's PHP version, build and module list, configuration paths and environment variables to anyone who loads it. | 570 | medium |
| /actuator/health | An automated scan for Spring Boot Actuator management endpoints, which expose configuration, environment properties and full JVM heap dumps whenever they are reachable without authentication. | 434 | medium |
| /SDK/webLanguage CVE-2021-36260 · KEV | An automated probe for the web server of Hikvision cameras and recorders, the endpoint associated with the CVE-2021-36260 command injection flaw. | 306 | low |
| /.aws/credentials | An automated scan for the AWS shared credentials and config files, which hold long-lived access keys and profile settings in plain text whenever a web server hands one back. | 247 | medium |
| /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh CVE-2021-41773 · CVE-2021-42013 · KEV | An attempt to exploit the Apache HTTP Server path traversal flaw, walking out of /cgi-bin/ with encoded dot segments to reach files — usually /bin/sh — outside the directories the server was configured to serve. | 181 | medium |
| /mcp | An automated scan for Model Context Protocol endpoints — the HTTP paths an MCP server exposes for tool calls and its Server-Sent Events stream — looking for AI integrations that answer without authentication. | 181 | low |
| /containers/json | An automated probe for the Docker Engine API's container-listing endpoint, which on a daemon reachable over the network answers without any authentication and gives the caller control of the host. | 72 | medium |
| /webui/ CVE-2023-20198 · CVE-2023-20273 · KEV | An automated scan looking for the Cisco IOS XE web management interface, so the host can be added to a target list for the privilege-escalation and command-injection pair tracked as CVE-2023-20198 and CVE-2023-20273. | 68 | high |
| /geoserver/web/ CVE-2024-36401 · KEV | An automated check for whether a GeoServer instance is reachable on this host, usually as the first step before an attacker tries the OGC endpoints that CVE-2024-36401 abuses. | 63 | medium |
| /developmentserver/metadatauploader CVE-2025-31324 · KEV | An automated check for the SAP NetWeaver Visual Composer Metadata Uploader endpoint, the unauthenticated upload point behind CVE-2025-31324. | 59 | high |
Access-log coverage: 27 days. Counts refresh weekly.
Have a whole access log to read?
The free browser analyzer reads nginx and Apache access logs, groups probes and scanners by source, flags any probe that got a 200 back, and links every known probe to these pages. Nothing is uploaded.