1

My Apache access log contains weird GET and POST requests, is it possible to examine which of these are harmful? For example:

114.232.151.185 - - [11/Jun/2014:20:11:33 +0200] "GET http://hotel.qunar.com/render/hoteldiv.jsp?&__jscallback=XQScript_4 HTTP/1.1" 404 1167

103.30.175.10 - - [12/Jun/2014:08:35:17 +0200] "GET /vtigercrm/ HTTP/1.1" 404 1034
69.174.245.163 - - [14/Jun/2014:01:22:38 +0200] "GET /w00tw00t.at.blackhats.romanian.anti-sec:) HTTP/1.1" 404 1034

69.174.245.163 - - [14/Jun/2014:01:22:38 +0200] "GET /phpMyAdmin/scripts/setup.php HTTP/1.1" 404 1034
94.74.229.110 - - [16/Jun/2014:18:46:43 +0200] "GET http://www.msftncsi.com/ncsi.txt HTTP/1.1" 404 1037
80.73.11.164 - - [20/Jun/2014:01:52:14 +0200] "POST /cgi-bin/php?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%64+%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+%63%67%69%2E%72%65%64%69%72%65%63%74%5F%73%74%61%74%75%73%5F%65%6E%76%3D%30+%2D%6E HTTP/1.1" 404 1034
162.253.66.76 - - [24/Jun/2014:23:54:30 +0200] "GET /rutorrent HTTP/1.1" 400 226

122.226.223.69 - - [25/Jun/2014:01:14:27 +0200] "GET http://todd0738.gotoip4.com//hello.html HTTP/1.1" 404 1041

My Apache access log file: http://pastebin.com/2x0naQBK

  • 1
    Welcome to the site. Please edit the question to be more specific by adding an example request that you're concerned with. – dan Aug 24 '14 at 2:17
  • I agree. I followed your link and it is too long for us to go through especially in light of the fact we do not what your configuration is and what access would be correct. Please give us a good sample. Also let us know what is installed in the way of any web application. This is right up my alley and there are other security experts here too. – closetnoc Aug 24 '14 at 2:34
  • I assume these are not your domains in these log sames. Are these log samples from your blogspot account? – closetnoc Aug 24 '14 at 3:37
  • I re-read your question. Obviously, this is not your blogspot site. Can you tell us more about your configuration? This looks like it can be bad routing. Are you using a host? Do you have a firewall? Do you have just one site on this server? If not, then is this log from a particular site such as the first one created? Are any of these your domains in the log examples? Can you tell us more? – closetnoc Aug 24 '14 at 5:32
  • This is a Apache Friends XAMPP web server on my VPS. Not a blogspot blog. – Konstantin Aug 24 '14 at 15:37
1

These sort of entries are common with most websites. I get plenty of them in my apache logs. If you have a secure server configuration, there is nothing to worry about.

For example, the fourth entry was probably some bot looking for a phpmyadmin installation file on your server. The second entry was probably a purposeful stray entry for promotional purposes. If your server is properly configured to serve a 404 or an access denied to those requests (which it is doing at the moment), there is absolutely nothing to worry about.

  • 1
    If you get a lot of these hacky requests then it would perhaps be more efficient to terminate the request and return an empty response. – MrWhite Aug 24 '14 at 20:45
  • @w3d Agreed there. But in my case, at the moment, these requests are not severe enough to hamper my daily traffic and hence is not worth my time. At some point of time in the future, I surely will. – Rana Prathap Aug 26 '14 at 9:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.