Skip to main content
11 votes
Accepted

Was user-agent identification used for some scripting attack techique?

This is a Joomla 0 Day Attack. Information found here: https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html This is not a vulnerability test despite the __test. It is ...
closetnoc's user avatar
  • 32.9k
4 votes

Was user-agent identification used for some scripting attack techique?

The IP address that you linked does not resolve to a Google hostname therefore it is not Google. The person or bot is scanning your site for vulnerabilities. The first one is attempting to find a ...
Simon Hayter's user avatar
2 votes
Accepted

How to parse Apache access log for 404s not from bots?

This can be done using the -v (for --invert-match) option of grep: grep -v "excluded_word" access_log | grep ' 404 ' grep -v "excluded_word" access_log will return all the lines that don't have the ...
Steve's user avatar
  • 8,513
2 votes
Accepted

Thousands of "Apache/2.4.41 (Unix) OpenSSL/1.0.2r (internal dummy connection)" in my logs

Don't worry, this is normal. When the Apache HTTP Server manages its child processes, it needs a way to wake up processes that are listening for new connections. To do this, it sends a simple HTTP ...
Atarax's user avatar
  • 66
2 votes

Was user-agent identification used for some scripting attack techique?

Additionally to other answers, note that the fact that this attack apparently worked suggests you are running an old, insecure version of PHP. A fix for the bug that this attack exploits was released ...
Periata Breatta's user avatar
2 votes

HOWTO log only slow requests in apache httpd

The CustomLog directive allows you to set a condition (in an optional 3rd argument) that is used to control when the request is logged. (On Apache 2.4+ this can take the form of an Apache Expression.) ...
MrWhite's user avatar
  • 42.9k
2 votes
Accepted

How to set web server log files deletion at certain interval in shared hosting?

If your shared hosting provider uses cPanel and you use cPanel to manage your website, cPanel has the function to automatically delete old log files after 30 days. Screenshot from the "Raw Access" ...
termsfeed's user avatar
  • 720
1 vote

AH00128: File does not exist - index.html no loading

the webserver configuration file domain.com.conf was missing ServerAlias www.domain.com systemctl restart httpd site loads!
mister mcdoogle's user avatar
1 vote
Accepted

Apache Logs: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/69.0.3497.81 Safari/537.36

You can take several approaches: If using Cloudflare, or similar, you can block everything coming from AWS, by enabling a WAF rule to provide a challenge or directly block anything coming from ASIN ...
Luis Alberto Barandiaran's user avatar
1 vote

How to parse Apache access log for 404s not from bots?

I find that one of the most useful ways to analyze 404 errors from a log file is to look at the referrer. You want to know where the 404 error was clicked, and the referrer tells you that. In ...
Stephen Ostermiller's user avatar
1 vote
Accepted

Multipe Bots Simultaneously Hitting Site

There are occasions where a large number of search engines will try to index your site at once. As has been mentioned in the comments this can be from one or more of the large number of ping tools on ...
Chris Rutherfurd's user avatar
1 vote

Google Crawl rate & the log file mystery

The value Google is showing (~5000) it's how much they "set aside" to crawl your website, based on what they think it'll be needed - it doesn't mean they will use it or even that there's a need for ...
Andre Guelmann's user avatar
1 vote

Matomo outputs "hostname X doesn't match Y"

Figured out that this is a SSL verification issue. Older python versions don't validate ssl certificates at all, thus the one matomo instance was working fine and the other not. The exception is ...
dr0i's user avatar
  • 129
1 vote

What is module/aciton/param1 entry in access logs about?

First of all redirecting all unknown pages to your homepage has the potential to badly affect your SERP ranking as the crawler will see a potentially huge number of pages which don't actually exist as ...
Chris Rutherfurd's user avatar
1 vote
Accepted

What means the part between the date and the server answer in Apache’s log?

The first URL should be the file that is access, while the second one is the referrer, aka the file/page that made the browser access the first URL. You can configure what shows up in your log files. ...
Pit's user avatar
  • 973

Only top scored, non community-wiki answers of a minimum length are eligible