11

This is a Joomla 0 Day Attack. Information found here: https://blog.sucuri.net/2015/12/remote-command-execution-vulnerability-in-joomla.html This is not a vulnerability test despite the __test. It is an attack. Make sure that any Joomla install is as up to date as possible. Another option is to simply use .htaccess to intercept this exploit by looking for ...


10

That means that the visitor did not send a referrer for the request. That can happen if: The user was a "direct" visitor and typed the URL into the browser bar or used a bookmark. The user followed a link from outside the browser (for example from an email or mobile app.) The user came to your non-secure http site from a secure https site and the browser ...


6

Apache writes to the log file after the request has been completed. It is able to remember the time that the request was started and write this time into the log file after the request was finished. This means that Apache log files are not going to be strictly ordered. There may be earlier records that get recorded late because the requests takes a long ...


5

I couldn't find anything related to that request so if it is anything malicious it hasn't come to light yet. I also don't see how it could be used to harm your site. Having said that, the bad guys seem to be one step ahead of us so if this request doesn't serve any useful purpose on your site I would try to block it. Even if only to keep your logs from ...


4

The IP address that you linked does not resolve to a Google hostname therefore it is not Google. The person or bot is scanning your site for vulnerabilities. The first one is attempting to find a Joomla vulnerability. These events are a regular occurrence on most websites, You should ensure that you are following best practices and harden your website, the ...


4

I'm assuming that the bind.php file is not actually a part of Joomla, but rather a malicious script that the hacker uploaded to your site. In particular, just looking at the request parameters, it appears likely that the script is being used to send e-mail spam, possibly using someone else's hijacked e-mail account. Here's what the request parameters in ...


3

This may seem odd, however, there may be a valid explanation. Apache can log either the access (start) time or the completion time. At one point, when the feature to select access or completion time was new, Apache changed the default from access to completion, but when the inevitable backlash came, quickly changed the default back to access time. However ...


3

They come from web scrapers incorrectly using Yahoo! Search result. This discovery was made by @tenants at XenForo forum. They explain more of the implications of receiving these requests and how they handle them. 1. Do you think we should be concerned with these requests? You don’t have to be concerned with these requests. They are just hallmarks of dumb ...


3

You can setup Google Analytics to exclude based on the referrer domain. See this for more: Google Analytics - Exclude referrers Also, you could block these based on the referrer as well via your .htaccess or Apache conf file, like this: RewriteCond %{HTTP_REFERER} ^.*\.doubleclick\.net.*$ [NC] RewriteRule ^(.*)$ - [F] (rather than blocking multiple IP ...


2

Apache supports rotating logfiles. Check the manual here, specifically the following example: CustomLog "|bin/rotatelogs -l /var/logs/logfile.%Y.%m.%d 86400" common


2

It seems you are not doing anything wrong. I can asure you, that is not the baidu spider. The baidu spider would have a footprint like: "GET /someurl HTTP/1.1" 200 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)" The log indicates a HTTP spammer. A lookup on the given IP: https://cleantalk.org/blacklists/118.244....


2

Yes, this bot is trying to exploit JCE. It’s probably using a very powerful publicly available exploit (+ mirror) for JCE < 2.0.11. Although this is a really outdated version, many instances are still in the wild. JCE 2.0.11 was released on 2011-08-29, the exploit has been available after the release (if its author kept his word). If JCE is not installed ...


2

Is this file supposed to be a new legal file required to comply with world law where its contents describe the rules for my website usage, or does it belong to a special content management system? License.txt is simply a generic name for any license file. There is no web "standard" or convention for "license.txt" files like there is for, say, robots.txt or ...


2

Place that log outside of your webroot. That way the only way to access it is through a script which can contain authentication (i.e. a password).


2

It has been a long time since I have posted blocking code. I have not updated my IP database in a fairly long time. I have somewhat shutdown my abuse list after 8 years. But this should be close enough. It is certainly an example at least. I recommend looking halfway down for the heading Block by IP Address Block. The .htaccess code should work. I am ...


2

This site is hosted on GoDaddy and is parked for the moment. The IP address for savetheworldheritage.org is 50.63.202.37. There is no specific information about this host that can be relied upon at this point. I have these similar IP address in my database: AS Number AS47147 - VisNetwork Media SRL 146.0.32.13 146.0.32.144 Of these, I have several domain ...


2

The CustomLog directive allows you to set a condition (in an optional 3rd argument) that is used to control when the request is logged. (On Apache 2.4+ this can take the form of an Apache Expression.) However, this condition is generally based on a property of the request (file type, request header, etc.), rather than something that is associated with the ...


2

If your shared hosting provider uses cPanel and you use cPanel to manage your website, cPanel has the function to automatically delete old log files after 30 days. Screenshot from the "Raw Access" page of cPanel; note the "Remove the previous month's archived logs from your home directory" option:


2

Additionally to other answers, note that the fact that this attack apparently worked suggests you are running an old, insecure version of PHP. A fix for the bug that this attack exploits was released in september 2015. Run your update process and make sure it pulls in the most recent version of PHP. And check for other outdated programs that are Internet-...


2

Don't worry, this is normal. When the Apache HTTP Server manages its child processes, it needs a way to wake up processes that are listening for new connections. To do this, it sends a simple HTTP request back to itself. Everything is explained here: https://cwiki.apache.org/confluence/display/HTTPD/InternalDummyConnection


2

This can be done using the -v (for --invert-match) option of grep: grep -v "excluded_word" access_log | grep ' 404 ' grep -v "excluded_word" access_log will return all the lines that don't have the unwanted word and then it is piped to grep ' 404 ' to list only lines with that pattern. Since an access_log can be pretty big, a faster way is to use awk awk ...


1

Figured out that this is a SSL verification issue. Older python versions don't validate ssl certificates at all, thus the one matomo instance was working fine and the other not. The exception is aurllib2.URLError and the cause is a SSL-verification. To bypass this one could simply start the script like this: PYTHONHTTPSVERIFY=0 python matomo/misc/log-...


1

There are occasions where a large number of search engines will try to index your site at once. As has been mentioned in the comments this can be from one or more of the large number of ping tools on the web which tell all search engines out there that there is new content to be indexed. You have done the right thing in verifying the IP's as resolving to ...


1

First of all redirecting all unknown pages to your homepage has the potential to badly affect your SERP ranking as the crawler will see a potentially huge number of pages which don't actually exist as existing and being exact duplicates of your homepage. If a page does not exist on your server according to standard and as is best practice for SEO your server ...


1

The first URL should be the file that is access, while the second one is the referrer, aka the file/page that made the browser access the first URL. You can configure what shows up in your log files. Typically by modifying the 'LogFormat' lines in your /etc/apache2/apache2.conf More information about what information you can show: http://httpd.apache.org/...


1

The most important thing that identifies the source of the request is the IP address. The savetheworldheritage.org part is a user-agent string that anyone can manipulate if they have the correct tools. In fact, on http://www.webpagetest.org/, one can change the user agent in the "chrome" tab. Just make sure you check the IP address by searching for it on ...


1

Depends on what you mean exactly by a click. If you are trying to track what part of a screen a user is clicking in general, then you'll need to use javascript click handlers along with some ajax to let the server know about the click. If however, you want to know what links on your website a user has clicked, it will be stored in server logs. In a ...


1

LogFormat and similar Apache and other major players in the web service space generally will allow customisation to access and error logs. The access log of "GET hostname/~username/proj/favicon.ico HTTP/1.1" is normal and working as intended, it is happening because your host is using LogFormat to output a log more to their liking. In this case its most ...


1

A really simple way to get them indexed would be to create a google webmaster tools account, claim your domain and then submit a complete sitemap. Depending on the authority of your site, Google is going to make resource decisions about how much effort to put into spidering your site.


Only top voted, non community-wiki answers of a minimum length are eligible