Put a server online, give it a public address, and something will start knocking within minutes. Not a person. A machine, running a script, working through a list. It has never heard of you, does not care what your site is for, and will keep going long after it fails. This is the normal background weather of the modern internet, and once you have seen it in your own logs you cannot unsee it.
I want to show you what that actually looks like, using real traffic from a small site I run, and then explain what these bots are hunting for and how to make yourself a boring target.
The numbers are not subtle
Over a single week, one modest site logged more than three thousand requests for pages that do not exist and never have. Not typos. Not broken links. Deliberate requests for files that only matter if your site is already broken into.
Here is a sample of what came knocking, straight from the logs:
/wp-plain.php
/admin.php
/inputs.php
/adminfuns.php
/wp-content/themes/seotheme/db.php
/wp-content/plugins/hellopress/wp_filemanager.php
/wp-content/plugins/fix/up.php
/ALFA_DATA/alfacgiapi/perl.alfa
/byp.php
/222.php
/cgi-bin/None of those exist on the site. That is the point. The bot does not know that. It is reading from a dictionary of known backdoor filenames and hoping one of them answers.
What they are actually looking for
Almost every one of those requests falls into a small number of categories.
Leftover shells. Files like byp.php, 222.php, x.php, and k.php are web shells: tiny programs an attacker uploads after a break in so they can run commands later. Scanners look for shells that someone else already planted. If they find one, they inherit a site that is already compromised, no effort required.
Fake plugins and themes. Paths like wp-content/plugins/fix/up.php and wp-content/themes/seotheme/db.php imitate real plugin folders. Malware often hides inside a folder with an innocent name so it blends in with legitimate files. Bots probe for the specific names that known malware families use.
File managers and command tools. The ALFA_DATA path and the various filemanager requests are looking for well known attack toolkits. ALFA is a notorious hacking panel. A scanner that finds it has hit the jackpot: a full control interface sitting unprotected.
Config and admin endpoints. Requests for admin.php, wp.php, and generic cgi-bin paths are fishing for management interfaces that were left exposed, misconfigured, or shipped with weak defaults.
The unifying theme: none of this is personal. The bot is not attacking your site specifically. It is attacking every site, yours included, checking each one against the same checklist.
They lie about who they are
The requests do not announce themselves as bots. Looking at how they identified themselves, the most common signature was no identification at all, followed by a string pretending to be an ordinary desktop browser. A few were sloppier. One repeat offender identified itself as Mozlila/5.0, a misspelling of Mozilla that no real browser has ever sent. That typo is a fingerprint: it means the tool author built a fake browser string and never checked it.
The lesson is simple. You cannot trust what a client says it is. A request claiming to be a person on a laptop is just as likely to be a script on a rented server on the other side of the world.
Why they can afford to do this
Scanning the entire internet is cheap now. Address ranges are public. Tooling is free and widely shared. Compromised machines and cheap cloud instances give attackers endless places to run from. The economics are brutally simple: if scanning a million sites costs almost nothing and one in a thousand has an unpatched hole, the operation is profitable. You are one line in a list that never ends.
This is why the knocking never stops and never will. It is not a sign that you have been noticed. It is the cost of having an address.
The good news: most of this fails harmlessly
Every one of those three thousand probes hit a site that simply did not have the file being asked for. The server answered “not found” and moved on. No shell, no file manager, no exposed admin panel, nothing to inherit. The scan was a waste of the bot’s time.
That is the whole game. You are not trying to stop the knocking. You cannot. You are trying to make sure that when a bot works through its checklist, every single item comes back empty.
How to be a boring target
You do not need an expensive security product. You need to not be the low hanging fruit.
Keep everything updated. The single biggest source of real break ins is out of date software with a known, published hole. Bots specifically hunt for versions with public exploits. Patching closes those doors before the scanner arrives.
Delete what you do not use. Every plugin, theme, and old script is another file that could have a vulnerability. Unused code you forgot about is exactly the kind of thing that gets exploited. If you are not using it, remove it, do not just disable it.
Never leave test or backup files in a public folder. Files named test.php, backup.zip, info.php, or admin.php are on every scanner’s list. If you must create one, put it somewhere the web server cannot serve, and delete it the moment you are done.
Lock down the front door. Your login page will be attacked constantly. Use a long unique password, enable a second factor, and rate limit failed attempts so a bot cannot try thousands of guesses.
Block the noise at the edge. A basic firewall or a filter that rejects requests for obvious backdoor filenames will absorb most of this before it ever reaches your application. It also keeps your logs readable, so real problems are easier to spot.
Read your logs occasionally. You do not need to watch them all day. But glancing at what is being requested, and what is failing, teaches you more about the real threat landscape than any headline. The first time you see the Mozlila typo scroll past, the internet stops feeling abstract.
The mindset that matters
The internet does not owe your server peace and quiet. The moment it is reachable, it is being measured, catalogued, and tested by machines that will never stop. That sounds grim, and the first time you watch it happen in your own logs it genuinely is unsettling.
But the fix is not fear. It is hygiene. Patched software, no leftover files, a locked front door, and a filter for the obvious junk will defeat the overwhelming majority of what is out there, because the overwhelming majority of what is out there is lazy, automated, and looking for someone easier than you.
Be boring. Be patched. Be the site where every item on the checklist comes back empty.
Leave a Reply