Page 1 of 1

Strange requests in error log - (Apache, Linux)

Posted: Fri Jan 27, 2006 3:53 pm
by mikebr
I was looking through the error log of my server and see that there are some really strange URL errors, it's like the path for the requested document actually ends in some bits of code from text styles. There are a series of about 60 'File does not exist:' errors all from the same IP address, there are no other (Correct) page requests from this ip address, here are some sample lines of errors:

File does not exist: /home/user/public_html/some_folder_on_my_site/e</some_folder_on_my_site/index.php
File does not exist: /home/user/public_html/some_folder_on_my_site/ans-serif;
File does not exist: /home/user/public_html/some_folder_on_my_site/t-family:
File does not exist: /home/user/public_html/some_folder_on_my_site/}.middle
File does not exist: /home/user/public_html/some_folder_on_my_site/S="verdana12White"
File does not exist: /home/user/public_html/some_folder_on_my_site/Typewriter;
File does not exist: /home/user/public_html/some_folder_on_my_site/ans-serif;
File does not exist: /home/user/public_html/some_folder_on_my_site/olor:
File does not exist: /home/user/public_html/some_folder_on_my_site/rdana,Arial,Helvetica,sans-serif;
File does not exist: /home/user/public_html/some_folder_on_my_site/ER=0
File does not exist: /home/user/public_html/some_folder_on_my_site/FFFFF;}.grey
File does not exist: /home/user/public_html/some_folder_on_my_site/OWNER
File does not exist: /home/user/public_html/some_folder_on_my_site/0px;height:

I tried tracing the IP address where the requests came from but it seems it doesn't exist.

Anyone know what might be happening here?

Thanks

Posted: Fri Jan 27, 2006 4:27 pm
by feyd
looks like really bad page code.. :?

Posted: Fri Jan 27, 2006 4:35 pm
by mikebr
Bad page code in what way?

There are no other errors of this type in the error log, just about 60 one after the other from the same ip address on the same day at the same time, if it where bad code there would be more of these and from other ip addresses would there not?

Thanks

Posted: Fri Jan 27, 2006 6:20 pm
by feyd
what other logs of this happening do you have? Such as the access logs, agent logs and such.. It may lead to some clues.

It may also be a case of someone testing a script on a remote host to see if it'd work (for doing something, I'm not sure) ... it may help to see the full page code it was being run against (final rendering sent to browser)

Posted: Fri Jan 27, 2006 7:13 pm
by mikebr
This is one of the lines from the raw access log, same IP and time as the errors from the error log:

38.118.25.60 - - [23/Jan/2006:05:30:54 +0000] "GET /some_folder_on_server/0 HTTP/1.1" 404 13399 "http://www.domain.com/some_folder_on_se ... 8fd555711b" "Mozilla/4.0 (compatible; MSIE 6.0; Windows XP)"

Does this help any more apart from telling the Browser and platform?

Thanks