title: What are `/t.php` GET requests coming to production server?
body: <p>I have recently published welcome page on my new site hosted on DigitalOcean. I'm using Node JS and nginx.</p>
  
  <p>These requests targeting <code>/t.php</code>, POST <code>/wls-wsat/CoordinatorPortType</code>, <code>POST /user/register?</code>.</p>
  
  <p>Is this a hacking attempt?</p>
  
  <p>Here are nginx logs -</p>
  
  <pre><code>80.123.42.103 - - [24/Apr/2018:16:38:54 +0000] "GET /t.php?c=%5B%7B%22k%22%3A%22%5Cb%22%2C%22t%22%3A9874541096%7D%5D HTTP/1.1" 404 144 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0"
  80.123.42.103 - - [24/Apr/2018:16:38:54 +0000] "GET /t.php?c=%5B%7B%22k%22%3A%22%5Cb%22%2C%22t%22%3A9874541264%7D%5D HTTP/1.1" 404 144 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0"
  
  80.13.73.224 - - [24/Apr/2018:08:47:10 +0000] "POST /wls-wsat/CoordinatorPortType HTTP/1.1" 400 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
  80.13.73.224 - - [24/Apr/2018:08:47:10 +0000] "POST /user/register?element_parents=account/mail/%23value&amp;ajax_form=1&amp;_wrapper_format=drupal_ajax HTTP/1.1" 404 153 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
  80.13.73.224 - - [24/Apr/2018:08:47:10 +0000] "GET / HTTP/1.1" 200 3508 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36"
  80.13.73.224 - - [24/Apr/2018:08:47:10 +0000] "GET / HTTP/1.1" 200 3508 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36"
  80.13.73.224 - - [24/Apr/2018:08:47:11 +0000] "GET /rss.php?mode=recent HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.132 Safari/537.36"
  </code></pre>