4

On some of our sites /404.html is being requested by different IP addresses, every second or so. The request is not accompanied by other resources loading on the page and will quite often then alternate to request /favico.ico.

No referring URL is present and the traffic is coming from different user agents, status codes are usually 200 or 304 - the file has been requested nearly 5000 times this month.

404.html requests

The 404.html page is not loading as a result of an error, a bad request or as a result of a rule in .htaccess, it is being requested.

Is this a new form of attack?

Improve this question
2
  • 2
    This is likely a script kiddie profiling script looking for specific install bases for potential future attacks. This does not mean you will be attacked. They are looking for potential vulnerabilities. Make sure all of your software is up to date including OS, web server, CMS, plugins, and themes. Also make sure you are protecting your systems as much as you can. Cheers!!
    – closetnoc
    Commented Apr 26, 2018 at 17:28
  • Could it be that a) the URI for favicon resources in your delivered pages is misconfigured and b) your 404 handling is misconfigured? Not too many sites have their favicon in so many folders, it is usually in the site root.
    – Willtech
    Commented May 26, 2018 at 9:20

2 Answers 2

Reset to default
1

People don't just go to 404 pages, I think you need to track the traffic source maybe you have broken URL. if you found direct referral maybe there are some people with bad intention.

Improve this answer
0

It depends on how your server is setup. But assuming you have installed professional server software (example: cpanel/WHM), It is likely possible that the server has the system set up so that if a page is not found, then the 404.html or equivalent is called. If the file is found, then the server will load that particular HTML page instead of a generic error message on the screen.

It is highly recommended you configure your server so these 404.html pages do get served as actual HTML pages with at least one link that directs the user to a valid page of the website.

Improve this answer
1
  • I don't think you have understood my question, I am using WHM/CPanel, there is a valid 404.html page with a link to the front page of the website, but there is no reason why /404.html is being requested by multiple IP addresses every second
    – zod
    Commented Apr 26, 2018 at 5:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.