Naw, you’re fine. It’s just russian bots trying to scrape your site, looking for vulnerabilities.

This may prove helpful: https://stackoverflow.com/questions/58249085/how-to-solve-facade-ignition-http-middleware-ignitionenabled

Welcome to the Internet. Check out Crowdsec and WAFs

This looks like a port scanning address, which is normal. Being scanned is just a fact of life if you host a service on the internet. What exactly was in your access log? Is it a connection on / ? Is it a 404 on a weird path? Is it accessing data on a service you run?

Personally, I’d block the IP and move on, since 99 times in 100, its not too big of a deal since an automated scan won’t do much. If it is scanning services you actively run, it would warrant digging in deeper, reading all logs and bit more closely, but it is still not too likely it will result in an intrusion.

The unfortunate truth of the internet is that once you reveal a service to it, bots and crawlers will be over that service immediately. As long as you have a firewall, your server is up-to-date, and your services are behind some sort of login page or allow list, you’ll be fine

Normal background noise. You expose stuff to the public and in return you make friends with a bunch of bots.

/_ignition/execute-solution

It’s a bot trying to scan for an exploit for Laravel (a PHP framework). You’ll see thousands of those types of scans drive by every day. Welcome to the Internet. Last time I deployed a new server online it took about 2 minutes for the first one to come knocking.

You can use something like Crowdsec to block this, or some other solution if you want to keep your services on the internet via a proxy.

Alternatively, if you’re the only user, don’t host them on the Internet directly, but hide them behind a VPN.