3

I am in charge of a server that is receiving strange requests for a file that doesn't exist and it never existed and I am trying to find which account they are coming from (CentOS + Plesk)

The logs look like this:

65.52.129.119 - [09/Jul/2015:16:30:35 +0100] "GET /FPURL.xml HTTP/1.1" 262ms 404 272 "-" "-"
65.52.129.119 - [09/Jul/2015:16:30:35 +0100] "GET /FPURL.xml HTTP/1.1" 263ms 404 275 "-" "-"

As you can see someone tries to access the file FPURL.xml but it doesn't say the domain or account.

Is there a way to find where it is coming from?

I have already checked the apache documentation but the only one I have seen is %h which is not recommended and %U which gives me /FPURL.xml.

3
  • What do you mean by "which account"?. All you've got to go on is the IP address. – paulmorriss Jul 9 '15 at 16:18
  • The server has hundreds of website, each one with it's own account. And this is the general Apache access_log, I want to see to which account it is going. Ie. www.example1.com/FPURL.xml or www.example2.com/FPURL.xml I want to know if it was www.example1.com or www.example2.com IP doesn't help at all. – DavidE Jul 9 '15 at 16:33
  • Updated answer based upon your comment. – closetnoc Jul 9 '15 at 16:49
3

This, at first blush, it looks like a Microsoft Hosting customer is trying to access a SharePoint file. It can be a simple on-line data collection effort or possibly a malware compromised computer seeking for vulnerabilities. It can go either way. There is very little information on this pattern yet to tell. I appears there may be malware that searches for this file, however, I could not find anything solid quickly. It appears to also be a common file for SharePoint and a request of this type may not be uncommon. I do not know SharePoint enough to comment nor am I aware of a particular vulnerability. The NVD database does not reference anything. It could be very new or nothing at all.

It is not anything I would worry too much about.

If you have SharePoint, then make sure it is up to date and secure. If not, do not worry about it- let it 404. If it is a pain, then you can block it.

Assuming Apache:

RewriteRule ^/?FPURL\.xml$ - [F,L]

This likely was addressed to the server using an IP address or a domain name not defined within the server configuration files. Some Apache installs have a catch-all site enabled immediately upon install. When the request does not match a defined domain name, the catch-all site handles the request. The catch-all site uses the default log file usually found in something like /var/log/apache2/access_log though it does not have to match this exactly- it all depends on the install package. This is likely what is happening. Still, nothing to worry about.

5
  • It is a Linux Server, with no SharePoint – DavidE Jul 9 '15 at 16:34
  • 1
    I would ignore it unless the number of requests gets out of hand- in the thousands. Then I would consider blocking. – closetnoc Jul 9 '15 at 16:44
  • 772 requests in 4 days. That RewriteCond is supposed to go in the htaccess, but I cannot copy in every htaccess of each website. Is there a master htaccess? – DavidE Jul 10 '15 at 8:03
  • I am not one for putting too much in the configuration files- no particular reason except that you have to restart the web server to see the change. It may end up being just as much editing. If it is only hitting your catch-all site (which is likely), then it is likely all you have to edit is the default site. You will know this by checking the log files. Your catch-all site is likely in /etc/apache2/sites-available/000-default.conf with a DocumentRoot directive that is /var/www/html. There you can put your .htaccess. Otherwise, it will be a bunch of cut-and-paste and going cross-eyed. – closetnoc Jul 10 '15 at 14:19
  • On some installs such as RadHat, you will see just one configuration file likely /etc/httpd/httpd.conf. These, by default, do not have a catch-all site but still can and likely manually added. In this case it is just one configuration file. Still, you would have to restart Apache for the changes to take effect. With the other install, there is the /etc/apache2/apache2.conf file- short of adding something, there is no obvious place to edit. It has been too long for me to recommend anything off the top of my head. I would have to think on this. – closetnoc Jul 10 '15 at 14:29
1

You want to configure Apache to log the "canonical ServerName of the server serving the request" using the %v log directive. I configure my Apache log format as:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %v" combinedserver
CustomLog /var/log/apache/access_log_virtual_hosts combinedserver

Reference:
http://httpd.apache.org/docs/2.2/mod/mod_log_config.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.