Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was going through page hit logs on awstats and I noticed the following two entries:


I was wondering if anyone recognised them and whether I should investigate.

I suppose it's nothing to be concerned about because they are listed as page not found errors by my cms but does anyone know what software this would be targetted at?

share|improve this question

migrated from stackoverflow.com Sep 8 '11 at 11:47

This question came from our site for professional and enthusiast programmers.

up vote 1 down vote accepted

Those files look like installation files for something like Wordpress, Joomla or Drupal etc. and if left on the system will doubt be a way in for hackers. The 'evil bots' are randomly checking for these kind of files (left over from incomplete installations) in order to find vulnerable sites. Although the 'lcivykmt' part of the filename should be a random string of characters so I would have thought this should be very hard to guess?!

share|improve this answer
Ja, I was thinking either remnant of install files from a cms or possibly some malware that is used to compromise sites (once some write access to the directory structure is gained) – jcuenod Sep 8 '11 at 16:54

That's probably a bot testing your site's security. Ban those IPs:

iptables -A INPUT -s <IP> -j DROP

Note: if you reboot, the iptables rules are lost, be sure to use a persistency system.

share|improve this answer

Probably these files would open some attack vector and that's why some evil bots are looking for them on servers they scan.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.