Unsolicited messages from Rancher

I have a simple python script that just adds a VM, waits for it to go active, then deletes it and waits for it to be purged. The app run flask to create a sort of proxy agent to Rancher. The good news is that Rancher seems to handle the requests well. I’ve run it many times, and Rancher does not appear to fail.

However, the first version of this script was a python 2 app. After a few iterations, the screen would be filled with garbage. Based on some guidance I found on unicode handling in Python, I switched to python 3 and I was able to see the readable text.

I don’t know if I care about this stuff or not. Please, advise.

There are a lot more of these sort messages but here is a sample from my screen.

173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /c99.php HTTP/1.0” 404 -
173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /c99.php HTTP/1.0” 404 -
173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /c99.php?act=cmd&d=%2Fvar%2Fwww%2Fhtml%2F&cmd=cat+%2Fetc%2Fredhat-release&cmd_txt=1&submit=Execute HTTP/1.0” 404 -
173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /wp-content/plugins/simple-popup-images/popup.php?z=%22%3E%3Cscript%3Ealert(%27QualysXSSTest%27)%3C/script%3E HTTP/1.0” 404 -
173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /robots.txt HTTP/1.0” 404 -
173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /store/WsError.asp?msg=%3Cscript%3Ealert%28%27XSS%27%29%3C/script%3E HTTP/1.0” 404 -
173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /test/guestbook_entries HTTP/1.0” 404 -
173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /javascript/jquery-1.6.2.js HTTP/1.0” 404 -
173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /index.php/component/acesearch/search?query=%22%3E%3Cscript%3Ealert(%22QualysXSSTest%22);%3C/script%3E HTTP/1.0” 404 -
173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /wp-content/plugins/wp-restful/html_api_authorize.php?oauth_callback=oauth_callback%27%3E%3Cscript%3Ealert(%22QualysXSSTest%22)%3C/script%3E HTTP/1.0” 404 -
173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /wp-content/plugins/wp-restful/html_api_login.php?oauth_token_temp=%22%3E%3Cscript%3Ealert(%22QualysXSSTest%22)%3C/script%3E HTTP/1.0” 404 -
173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /wp-content/plugins/cac-featured-content/timthumb.php?src=QUALYS_URL HTTP/1.0” 404 -
173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /wp-content/plugins/category-grid-view-gallery/includes/timthumb.php?src=QUALYS_URL HTTP/1.0” 404 -
173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /wp-content/plugins/auto-attachments/thumb.php?src=QUALYS_URL HTTP/1.0” 404 -
173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /wp-content/plugins/wp-marketplace/libs/timthumb.php?src=QUALYS_URL HTTP/1.0” 404 -
173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /wp-content/plugins/dp-thumbnail/timthumb/timthumb.php?src=QUALYS_URL HTTP/1.0” 404 -
173.37.95.222 - - [23/Oct/2015 17:19:25] “GET /wp-content/plugins/vk-gallery/lib/timthumb.php?src=QUALYS_URL HTTP/1.0” 404 -

That’s someone scanning for vulnerabilities and not coming from Rancher.

Since the source IP is in your company’s netblock and it says Qualys everywhere, I assume your company uses their continuous monitoring software and it’s just always spamming your internal network with vulnerability scans.

lol. Nice. Well, it’s good do know can ignore it.