Strange requests in error log - (Apache, Linux)

Need help installing PHP, configuring a script, or configuring a server? Then come on in and post your questions! We'll try to help the best we can!

Moderator: General Moderators

Post Reply
mikebr
Forum Contributor
Posts: 243
Joined: Sat Sep 28, 2002 7:05 am

Strange requests in error log - (Apache, Linux)

Post by mikebr »

I was looking through the error log of my server and see that there are some really strange URL errors, it's like the path for the requested document actually ends in some bits of code from text styles. There are a series of about 60 'File does not exist:' errors all from the same IP address, there are no other (Correct) page requests from this ip address, here are some sample lines of errors:

File does not exist: /home/user/public_html/some_folder_on_my_site/e</some_folder_on_my_site/index.php
File does not exist: /home/user/public_html/some_folder_on_my_site/ans-serif;
File does not exist: /home/user/public_html/some_folder_on_my_site/t-family:
File does not exist: /home/user/public_html/some_folder_on_my_site/}.middle
File does not exist: /home/user/public_html/some_folder_on_my_site/S="verdana12White"
File does not exist: /home/user/public_html/some_folder_on_my_site/Typewriter;
File does not exist: /home/user/public_html/some_folder_on_my_site/ans-serif;
File does not exist: /home/user/public_html/some_folder_on_my_site/olor:
File does not exist: /home/user/public_html/some_folder_on_my_site/rdana,Arial,Helvetica,sans-serif;
File does not exist: /home/user/public_html/some_folder_on_my_site/ER=0
File does not exist: /home/user/public_html/some_folder_on_my_site/FFFFF;}.grey
File does not exist: /home/user/public_html/some_folder_on_my_site/OWNER
File does not exist: /home/user/public_html/some_folder_on_my_site/0px;height:

I tried tracing the IP address where the requests came from but it seems it doesn't exist.

Anyone know what might be happening here?

Thanks
User avatar
feyd
Neighborhood Spidermoddy
Posts: 31559
Joined: Mon Mar 29, 2004 3:24 pm
Location: Bothell, Washington, USA

Post by feyd »

looks like really bad page code.. :?
mikebr
Forum Contributor
Posts: 243
Joined: Sat Sep 28, 2002 7:05 am

Post by mikebr »

Bad page code in what way?

There are no other errors of this type in the error log, just about 60 one after the other from the same ip address on the same day at the same time, if it where bad code there would be more of these and from other ip addresses would there not?

Thanks
User avatar
feyd
Neighborhood Spidermoddy
Posts: 31559
Joined: Mon Mar 29, 2004 3:24 pm
Location: Bothell, Washington, USA

Post by feyd »

what other logs of this happening do you have? Such as the access logs, agent logs and such.. It may lead to some clues.

It may also be a case of someone testing a script on a remote host to see if it'd work (for doing something, I'm not sure) ... it may help to see the full page code it was being run against (final rendering sent to browser)
mikebr
Forum Contributor
Posts: 243
Joined: Sat Sep 28, 2002 7:05 am

Post by mikebr »

This is one of the lines from the raw access log, same IP and time as the errors from the error log:

38.118.25.60 - - [23/Jan/2006:05:30:54 +0000] "GET /some_folder_on_server/0 HTTP/1.1" 404 13399 "http://www.domain.com/some_folder_on_se ... 8fd555711b" "Mozilla/4.0 (compatible; MSIE 6.0; Windows XP)"

Does this help any more apart from telling the Browser and platform?

Thanks
Post Reply