6

I checked the archives of the site but I was unable to see an answer to my question. Recently I've been researching who is responsible for th1s_1s_a_4o4.html but some of the forums seem to suggest Google is behind it.

Is there something I'm needing to do in particular with this code as I generate error logs regularly and I keep seeing this several times a week. I do run a custom 404.php file in my WordPress themes and when I check my 404.php with var_dump(http_response_code()); I get a successful int(404) returned.

Do I need to do anything else and would it be bad block this in my robots.txt, something like:

User-Agent: *
Disallow: /th1s_1s_a_4o4.html

Does returning a message for a 404 effect your rank at all?

  • In Webmaster Tools you can click the 404 and find out where it is originating from... if its external then 404 is working as intended.. and no... 404's do not effect your rankings if the issue is because site B is linking to site A incorrectly. – Simon Hayter Dec 8 '16 at 19:50
  • @SimonHayter if you can tell me where in Webmaster Tools and leave it as answer that would answer my question. At this time I show no crawl errors. – DᴀʀᴛʜVᴀᴅᴇʀ Dec 8 '16 at 19:52
  • 1
    What do you mean by "who is responsible for th1s_1s_a_4o4.html"? Are you implying that this "someone/bot" is requesting this file? And... you are getting a 404 reported? Where are you seeing the 404 report? Your access log reports exactly who/what has requested this file. And Google Search Console would also report from where it is being linked (if at all). Yes, as Stephen suggests, blocking a URL in robots.txt that otherwise returns a 404 anyway (ie. doesn't exist) doesn't make a lot of sense really. – MrWhite Dec 8 '16 at 20:10
  • 1
    So, presumably the log that you generate records the UA and IP of the request? This will confirm/deny whether it's Googlebot or not. The fact that it doesn't appear in GSC would be consistent with what Stephen suggested above. – MrWhite Dec 8 '16 at 21:02
  • 2
    This is a vulnerability test to see if a hackable 404 response is available. The file should not exist. Check to make sure the file does not exist. It is likely that Google is not checking for this file, or if it is, it is a result of a link. It is a possibility that it is sitelock.com One wordpress site is claiming it is Google, however, that is the only place I have seen this claim with nothing to back it up. The siteloack claim is at least backed up with IP addresses. What IP addresses are you seeing?? – closetnoc Dec 8 '16 at 21:47
5

Found this on a Site Lock Facebook page.

SiteLock - Website Security Thanks for the info. After looking into your account, you do have a free scanner provided by your hosting company. In order for us to verify that your 404 page is clean, we actually try to provoke a 404 error by making a request to a non-existent page (e.g. th1s_1s_a_4o4.html). Please let us know if you have any further questions!

2

Whatever is hitting your site with that URL, it doesn't look like it is Google. I checked my server logs and none of my sites have had that URL requested in the past month. If it were Googlebot, I would expect theme to request such a URL on all sites they crawl.

https://productforums.google.com/forum/#!topic/webmasters/MkfVFWOTl5I has a user agent from such a hit: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)" which isn't a user agent that Googlebot would use.

A responder in that thread checks the client IP address and determined that it isn't an IP address that Google uses.

There is a clue there about why this is happening though. In the case in which it was posted there was a referral URL along with the request: http://www.google.com/url?url=www.<censored-spam-site>.ca&yahoo.com. It looks to me like this is a spammer that is trying to get traffic to their site by spamming your 404 report and referral report. They are using Google as a redirector to make the URL look more legitimate. Also appending yahoo to it just for good measure.

It is safe to ignore spam like this.

  • LOL, This is odd. I read this answer exactly one year after I wrote the answer you linked to. – Oskar Skog Jul 21 '17 at 5:06
0

I had one hit my door step. Whom ever it is, its definitely not google. he's using it but it looks like he hacked google and yahoo acording to the visit. I just block these ip addresses when they make wierd request or request to things they shouldn't be seeing.

  here is that output from my visitors, feel free to block him:

   IP: 67.212.188.154
   URL: /th1s_1s_a_4o4.html 
   Bytes: 321 
   status: 301
   referred:  http://www.google.com/url?url=www.mywebsite.com&yahoo.com 
    UserAgent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/6.0)
  • Not good. that little code there caused my SEO rank to go to 0. It doesn't bother me much because that site has about 30K people on it and it growing crazy. So who ever this guy was, he didn't effect my business. – drtechno Mar 16 '18 at 11:33
  • i think I'll make a th1s_1s_a_4o4.html and redirect it to the NSA – drtechno Mar 16 '18 at 20:35
  • hmmm I get a 404 even after I make the file – drtechno Mar 16 '18 at 20:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.