My Apache access log contains weird GET and POST requests, is it possible to examine which of these are harmful? For example: - - [11/Jun/2014:20:11:33 +0200] "GET http://hotel.qunar.com/render/hoteldiv.jsp?&__jscallback=XQScript_4 HTTP/1.1" 404 1167 - - [12/Jun/2014:08:35:17 +0200] "GET /vtigercrm/ HTTP/1.1" 404 1034 - - [14/Jun/2014:01:22:38 +0200] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 1034 - - [14/Jun/2014:01:22:38 +0200] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 1034 - - [16/Jun/2014:18:46:43 +0200] "GET http://www.msftncsi.com/ncsi.txt HTTP/1.1" 404 1037 - - [20/Jun/2014:01:52:14 +0200] "POST /cgi-bin/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1" 404 1034 - - [24/Jun/2014:23:54:30 +0200] "GET /rutorrent HTTP/1.1" 400 226 - - [25/Jun/2014:01:14:27 +0200] "GET http://todd0738.gotoip4.com//hello.html HTTP/1.1" 404 1041

My Apache access log file: http://pastebin.com/2x0naQBK

  • 1
    Welcome to the site. Please edit the question to be more specific by adding an example request that you're concerned with.
    – dan
    Aug 24, 2014 at 2:17
  • I agree. I followed your link and it is too long for us to go through especially in light of the fact we do not what your configuration is and what access would be correct. Please give us a good sample. Also let us know what is installed in the way of any web application. This is right up my alley and there are other security experts here too.
    – closetnoc
    Aug 24, 2014 at 2:34
  • I assume these are not your domains in these log sames. Are these log samples from your blogspot account?
    – closetnoc
    Aug 24, 2014 at 3:37
  • I re-read your question. Obviously, this is not your blogspot site. Can you tell us more about your configuration? This looks like it can be bad routing. Are you using a host? Do you have a firewall? Do you have just one site on this server? If not, then is this log from a particular site such as the first one created? Are any of these your domains in the log examples? Can you tell us more?
    – closetnoc
    Aug 24, 2014 at 5:32
  • This is a Apache Friends XAMPP web server on my VPS. Not a blogspot blog.
    – Konstantin
    Aug 24, 2014 at 15:37

1 Answer 1


These sort of entries are common with most websites. I get plenty of them in my apache logs. If you have a secure server configuration, there is nothing to worry about.

For example, the fourth entry was probably some bot looking for a phpmyadmin installation file on your server. The second entry was probably a purposeful stray entry for promotional purposes. If your server is properly configured to serve a 404 or an access denied to those requests (which it is doing at the moment), there is absolutely nothing to worry about.

  • 1
    If you get a lot of these hacky requests then it would perhaps be more efficient to terminate the request and return an empty response.
    – MrWhite
    Aug 24, 2014 at 20:45
  • @w3d Agreed there. But in my case, at the moment, these requests are not severe enough to hamper my daily traffic and hence is not worth my time. At some point of time in the future, I surely will. Aug 26, 2014 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.