/q873 /s106 /s833 etc. - I get these requests constantly generating a 404. They are from Google, Amazon, CERF and others. What are these people wanting? Is it a dos attack? It's useless to ban the IP as they have dozens if not 100s. Anyone else seen these sort of URLs? Thanks.
-
Do not worry about 404 errors unless, of course, the page should exist. Mostly weird 404s come from bad links and generally from spam sites. Will not cause you harm. DoS attacks are just that, attacks. They are unmistakable and extremely rare. A bunch of 404s are not an attack. Annoying Yes! But not an attack. I would not worry about them. They are just a part of doing business these days. NEVER mark a valid 404 as being fixed. Just leave it alone.– closetnocApr 18, 2017 at 22:26
-
"They are from Google" - If these requests are from verified Googlebots (for instance) then it might indicate a misconfiguration on your site? Googlebot is finding the URLs somehow.– MrWhiteApr 25, 2017 at 9:40
Add a comment
|
3 Answers
Check your access logs or mod security logs if you have POST requests before these requests /q873 /s106 /s833 etc. Usually hackers try to create directories in server to test and upload shell using website vulnerabilities. If POST requests are present and block those ips. Check POST data through mod security logs to be on the safer side.
The google ones could just be search crawlers. The amazon ones could be from a snip of code somebody made on it, or amazon is crawling to create a search engine. It is okay, but be careful.
-
Thanks for the reply. I'm also getting 404s from REDIRECT_URL = /$$$&?&?$$$. I simply don't understand what they are trying to do? This is not from the IPs listed above. Are they deliberately trying to create a 404? Plus they are not creating them fast enough to bring down the site. And not that many. Seems like a steady stream. Apr 18, 2017 at 17:45
Well, I found a way to get rid of the bogus URLs. It's sure nice not seeing all those 404s. Below is the code I'm using. Thanks to all who replied.
RewriteCond %{REQUEST_URI} !\.htm$
RewriteRule ^([^.]+)((/)?)$ https://example.com [nc]
-
1"It's sure nice not seeing all those 404s." - That really depends on where you are "seeing all these 404s". In your access log this simply replaces the 404 with a 301 (and potentially a 200 OK to your home page) - this just masks the problem and makes genuine reporting harder.– MrWhiteApr 24, 2017 at 17:07
-
w3dk, what do you suggest? If I have it go to a 403 the server still logs it. So how do you actually get rid of someone so it's not a bearing on your server? Apr 24, 2017 at 22:49
-
To completely reduce load on the server then I would guess the only way is to implement some kind of front-end proxy server that is able to reject these requests from hitting your application server? Otherwise, a 404 (as closetnoc suggested in comments) is arguably the correct response. It's just unfortunate that the Google Search Console 404 report (if that is what you are referring to) gets swamped. The GSC reporting capability is not very good in this respect. (I meant "302" in my comment above, not "301".)– MrWhiteApr 25, 2017 at 9:48