Mass Portscanning?

[RiversideRocks]

I run a smallish website that received a little bit of traffic. Today I noticed a lot of odd port scanner requests to the website in the access log.

(a way to tell that a request is automated is if the visitor doesn’t request any CSS or Javascript assets)

This is a snippet of logs (ignore the internal dummy connections):
https://hastebin.com/yurezeyihi.yaml

This is what a legitimate request to / looks like:

Searching these IPs on the abuse IP database shows that a lot of them have been reported in the past. Any explanation to this? Is this a small botnet? Most of the IPs are fixed line. Normally port scanners make one request and leave the site.

[Martyr2]

One thing to know is that there are a TON of bots on the web. I manage tons of sites and you will always see these bots (some are spiders, some are scans, some are just bots doing crazy things even through bot nets). There is not much you can do about it other than if you identify some that are doing a ton of requests (hunderds a minute or something like that) you can block their requests ideally at the network/hardware level. You can also block them at the .htaccess level. If someone is abusing, I prefer to block the traffic before it even reaches webservers.

All part of managing web traffic in this day in age.