Going through my assess-logs today, I found so many entries trying to access pages. (that were not present). Like
- robots.txt (I know what this is used for)
- apply
- favicon.ico(I know what this is used for)
- etc
So, obviously a 404 was returned but there was other 3 digit code(?) along with 404.
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 312
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 285
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 286
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 287
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 288
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 289
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 290
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 295
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 296
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 297
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 298
ip-address - - [date & time] "GET /some/file_OR_folder HTTP/1.1" 404 301
A search gave me this: Samples of attacks detected by ossec - OSSEC Wiki:
Which says it was a web scan detected by ossec (looking for Wordpress, xmlrpc and awstats) .
What the second status codes(286, 289) for in the above log?
