File not found in apache error log

Question

I am trying to work out why we are getting alot of error coming into our apache error log that state 'File does not exist:' e.g.

File does not exist: /home/FTPUSER/public_html/category, referer: http://www.DOMAIN.co.uk/category/epson-stylus-c40sx/497/0-0-0-0-0-0-0-0/1

(Where FTPUSER is cpanel user name)

there isn't a reference to /home/FTPUSER/public_html/category anywhere in the code, any suggestions?

please also note that /category/epson-stylus-c40sx/497/0-0-0-0-0-0-0-0/1 is a mod rewrite rule for cat.php?id=497 etc...

Answer 1

It appears to me that you are seeing the results of some sort of automated/deliberate attack on your web server. Someone or some program is looking for an application possibly that was installed with no password or a default password or an application with a known vulnerability.

We get these all the time on the web sites we host and for anything like this, we can't respond too, we have either a custom 404 page or we issue a custom 301 to the home page of the site in question.

Answer 2

you could try looking at the access log for that domain to see if there is any correlation between a specific request and the generation of that error.

to find your logs try something like this:

grep CustomLog /etc/httpd/conf/httpd.conf

logfile will be somewhere like:

/usr/local/apache/domlogs/domain.co.uk

you could then grep this file for the time from the apache error log and see if that shows up anything?

Answer 3

My usual rule of thumb is that if the file does not exist (and never did) on my server, AND if the referrer URL is a zillion characters long (and not from your own site), the chances of it being an exploit attempt are pretty good.

Like ericmayo, we utilize mod_rewrite to forward any 404's to the main site. We have in the past done some coding where referer.log is parsed for exploit attempts and any suspect entries put into a "deny" list. (.htaccess is your friend)

If you're using apache, this might be of some assistance.

Answer 4

I'm with k3ri & ericmayo -- it's an automated exploit attempt.

having seen many similar exploit attempts in logs for over a decade, I long ago bailed out on attempting to add referrer IPs to deny lists -- because with literally millions of Windows clients pwned by bot-herders large and small, you end up creating lookup overhead for every request, thus increasing server latency more than you can ever gain from filtering out the ever-changing attack sources.