Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I checked the error_log today and found this suspicious:

    [Mon Nov 27 01:18:36 2011] [error] [client omitted] 
    File does not exist: /var/www/domain.com/htdocs/robots.txt
    [Mon Nov 27 01:18:45 2011] [error] [client omitted] 
    File does not exist: /var/www/domain.com/htdocs/robots.txt
    [Mon Nov 27 01:24:38 2011] [error] [client ommited] 
    script '/var/www/domain.com/htdocs/proxy-1.php' 
    not found or unable to stat
    [Mon Nov 27 01:24:57 2011] [error] [client omitted] 
    script '/var/www/domain.com/htdocs/judge112233.php' 
    not found or unable to stat

And I say suspicious because I am the only person using the site right now, so I know all the pages and I would never access those pages above. So is this a bot attack?

share|improve this question

migrated from stackoverflow.com Nov 28 '11 at 19:39

This question came from our site for professional and enthusiast programmers.

closed as not constructive by MDMarra, Greg Askew, mailq, Chris S, Iain Nov 28 '11 at 20:46

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

    
@jamewaffles sorry will think about it before posting. –  Sam Khan Nov 28 '11 at 19:33
    
No problem. Just some advice for future reference :-) –  Bojangles Nov 28 '11 at 19:35
3  
FYI, these are very common. They are of no concern... just bots looking for scripts that may have been uploaded to your server for remote control. You only need to be concerned if any of these requests succeed. –  Brad Nov 28 '11 at 19:36

4 Answers 4

Looks more like a web crawler to me.

share|improve this answer
    
this is the first time i have seen this so i have been panicking. what does that mean? –  Sam Khan Nov 28 '11 at 19:32
2  
Normally it means that Google is looking through your site, adding the pages to its index. Of course, it could be other search engines. Try looking up the IP address and/or the User-Agent header. –  Tom van der Woerdt Nov 28 '11 at 19:34
    
this is one the IPs: 58.218.199.147 –  Sam Khan Nov 28 '11 at 19:37
1  
That IP is a bad IP. ipillion.com/ip/58.218.199.147 does not look too legit. –  tacos_tacos_tacos Nov 28 '11 at 19:46

The 2 first could be a crawler for search engines attempting to get data from robots.txt

share|improve this answer

If you're looking at useragent, it's good to check the IPs you find as well. I've sen DOS attacks with spoofed googleBot useragent headers. the version 6.66 kinda gave it away, but it didn't have to.

share|improve this answer

Reading some of those comments on ipmillion found this:

 These machines are not Hackers/Crackers at all,they have merely been 
 Compromised.A scan of several of these ip blocks reveals that the 
 Machines are not Fire walled or running any kind of Security.
 They have basically been hijacked and are now being used as D
rones,ie BOTNETS. As for the people who have Compromised them!! 
They could be any were in the World.

So i guess you have nothing to worry about.

share|improve this answer