0

Our 404 error report shows that about 300 requests per day are made for /root/ncsi.txt.

My understanding is that this file is one way Windows checks for internet connectivity, by checking for this tiny text file on a Microsoft server.

So why are we getting requests for this file on our site? How do we resolve the 404 errors?

Note: We have apple and android mobile apps that rely on our server to function. Not sure if that is relevant.

Improve this question
1
  • Compromised computers are often rather stupid and look for the same vulnerability within the same IP address block to avoid detection over and over again. Sometimes is it an IP address block where another vulnerable computer exists. It is likely just vulnerability landscaping/testing. Do not worry about it if it does not represent a vulnerability on your system. Block it if it gets too annoying.
    – closetnoc
    Commented Dec 14, 2015 at 22:39

1 Answer 1

Reset to default
1

If your server is not dependent on that file to operate properly, then simply ignore the requests. Hackers with automated scripts make improper calls to servers every second of the day. The more popular your site becomes the more odd requests you will see.

If you have the resources to investigate, it does make sense to ensure that it's not actually a security hole on your server. Making the effort to do this depends on the purpose of your website.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.