Why is my Node.js app trying to retrieve random resources?

February 7, 2017 553 views
Nginx Node.js Ubuntu 16.04

I have a M(ySQL)EAN stack application that I deployed to a droplet on DigitalOcean. I use the pm2 process manager to run the Node.js server. All is working fine, but while running pm2 logs to see my app's console output I noticed my application is trying to retrieve random resources resulting in a bunch of 404 errors being printed to the console.

Example:

0|Destinat | GET /chris-jaymes-biography-imdb.pdf 404 1.138 ms - 44
0|Destinat | GET /messenger-oracle.pdf 404 1.125 ms - 33
0|Destinat | GET /names-of-god-bible.pdf 404 1.275 ms - 35
0|Destinat | GET /read-online-god-knows-my-size-silvia-trniceriu-by-harvey-yoder.pdf 404 2.201 ms - 79
0|Destinat | GET /connections-by-karin-bishop.pdf 404 3.528 ms - 44
0|Destinat | GET /read-online-noches-hmedas----oe-gabriel-arba.pdf 404 1.124 ms - 61
0|Destinat | GET /rape-victims-books.pdf 404 1.925 ms - 35
0|Destinat | GET /economics-now-analyzing-current-issues-textbook-answers.pdf 404 1.467 ms - 72
0|Destinat | GET /deepwater-horizon-2016-imdb.pdf 404 1.245 ms - 44
0|Destinat | GET /the-reluctant-vampire-argeneau-15-lynsay-sands.pdf 404 1.216 ms - 63
0|Destinat | GET /kango-637s-deelyey.pdf 404 0.825 ms - 35
0|Destinat | GET /wish-come-true-by-mary-q-steele.pdf 404 0.918 ms - 48
0|Destinat | GET /mandalay-wikipedia.pdf 404 1.494 ms - 35
0|Destinat | GET /an-historical-geography-of-france-cambridge-studies-in-historical-geography.pdf 404 1.065 ms - 92
0|Destinat | GET /rumi-in-books-ebay.pdf 404 0.979 ms - 35
0|Destinat | GET /doctor-sue-o.pdf 404 0.614 ms - 29
0|Destinat | GET /outdoors-northwest.pdf 404 1.358 ms - 35
0|Destinat | GET /read-online-dan-coates-easy-piano-collection-pop-country-movie-tv-hits.pdf 404 2.137 ms - 87
0|Destinat | GET /real-ayurveda-medical-books.pdf 404 0.761 ms - 44
0|Destinat | GET /teruel-anobii.pdf 404 0.928 ms - 30
0|Destinat | GET /i-am-jazz-facebook.pdf 404 0.970 ms - 35

I have no idea what these files are or where they're coming from. Any guesses on what's happening here???

1 Answer
jtittle1 February 7, 2017
Accepted Answer

@tammyprodev

This isn't specific to your application, or NodeJS -- it actually happens a lot. Since the IP's provided to your Droplet have most likely been shared with someone else at some point, random requests occur.

Someone running NGINX or Apache could, for example, see requests that are just as strange. The get logged because they are requested, not because they exist.

This could be due to someone scanning your domain/IP for the resources using an automated attack method (bash/shell script, or really any language), someone actually trying to match such requests or even links to the IP you're using elsewhere.

Since the requests are trying to access non-existent PDF files, you don't have much to worry about.

  • Ah ok, thanks! I was more so worried that it would have some effect on my droplet usage but thank you for clarifying.

Have another answer? Share your knowledge.