4

On some of our sites /404.html is being requested by different IP addresses, every second or so. The request is not accompanied by other resources loading on the page and will quite often then alternate to request /favico.ico.

No referring URL is present and the traffic is coming from different user agents, status codes are usually 200 or 304 - the file has been requested nearly 5000 times this month.

404.html requests

The 404.html page is not loading as a result of an error, a bad request or as a result of a rule in .htaccess, it is being requested.

Is this a new form of attack?

  • 2
    This is likely a script kiddie profiling script looking for specific install bases for potential future attacks. This does not mean you will be attacked. They are looking for potential vulnerabilities. Make sure all of your software is up to date including OS, web server, CMS, plugins, and themes. Also make sure you are protecting your systems as much as you can. Cheers!! – closetnoc Apr 26 '18 at 17:28
  • Could it be that a) the URI for favicon resources in your delivered pages is misconfigured and b) your 404 handling is misconfigured? Not too many sites have their favicon in so many folders, it is usually in the site root. – Willtech May 26 '18 at 9:20
0

It depends on how your server is setup. But assuming you have installed professional server software (example: cpanel/WHM), It is likely possible that the server has the system set up so that if a page is not found, then the 404.html or equivalent is called. If the file is found, then the server will load that particular HTML page instead of a generic error message on the screen.

It is highly recommended you configure your server so these 404.html pages do get served as actual HTML pages with at least one link that directs the user to a valid page of the website.

  • I don't think you have understood my question, I am using WHM/CPanel, there is a valid 404.html page with a link to the front page of the website, but there is no reason why /404.html is being requested by multiple IP addresses every second – zod Apr 26 '18 at 5:50

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.