Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I decided to take a look at /opt/lampp/logs/access_log today on my server and found a number of requests like this:

***.***.**.10 - - [03/Nov/2012:12:57:45 +0000] "GET /youjizz/a.php?config=hardcore-porn/alexis-texas-best-scene/video147842 HTTP/1.1" 404 1977
**.***.*.163 - - [03/Nov/2012:12:57:47 +0000] "GET /youjizz/a.php?config=anal-porn/Granny-Anal-1/video85068 HTTP/1.1" 404 1627
**.***.**.202 - - [03/Nov/2012:12:58:02 +0000] "GET /user.php?config=5rNdWxRZif5g HTTP/1.1" 404 1002
**.***.*.163 - - [03/Nov/2012:12:58:06 +0000] "GET /youjizz/a.php?config=teen-porn/Aaralyn-Barra-interracial-DP/video294307 HTTP/1.1" 404 1627
**.***.*.163 - - [03/Nov/2012:12:58:07 +0000] "GET /favicon.ico HTTP/1.1" 404 1002
**.***.**.7 - - [03/Nov/2012:12:58:08 +0000] "GET /yazhoushipin/12460-sheng-she-ji-cai-yue-12450-you-ma-11739.html HTTP/1.1" 404 1002
**.***.*.163 - - [03/Nov/2012:12:58:12 +0000] "GET /youjizz/a.php?config=blowjob-videos/Penocchio/video118230 HTTP/1.1" 404 1627
**.***.*.163 - - [03/Nov/2012:12:58:17 +0000] "GET /youjizz/a.php?config=group-sex/Kosziv/video118717 HTTP/1.1" 404 1627
***.**.**.135 - - [03/Nov/2012:12:58:30 +0000] "GET /favicon.ico HTTP/1.1" 404 1002
***.**.**.135 - - [03/Nov/2012:12:58:30 +0000] "GET /youjizz/a.php?config=softcore-videos/Passion-Cove-Deep-Desires/video59051 HTTP/1.1" 404 1999
**.***.*.163 - - [03/Nov/2012:12:58:52 +0000] "GET /youjizz/a.php?config=teen-porn/Curry-Creampie-2-CD1/video104640 HTTP/1.1" 404 1627
**.***.*.163 - - [03/Nov/2012:12:58:52 +0000] "GET /favicon.ico HTTP/1.1" 404 1002
**.***.**.86 - - [03/Nov/2012:12:58:52 +0000] "GET /topic/ HTTP/1.1" 404 1002
**.***.*.163 - - [03/Nov/2012:12:58:58 +0000] "GET /youjizz/a.php?config=softcore-videos/Passion-Cove-Deep-Desires/video59051 HTTP/1.1" 404 1627
**.***.*.163 - - [03/Nov/2012:12:59:05 +0000] "GET /youjizz/a.php?config=hardcore-porn/IESP443/video51001 HTTP/1.1" 404 1627
**.**.**.77 - - [03/Nov/2012:12:59:15 +0000] "GET /favicon.ico HTTP/1.1" 404 1002
***.***.***.108 - - [03/Nov/2012:12:59:29 +0000] "GET /youjizz/a.php?config=anal-porn/Granny-Anal-1/video85068 HTTP/1.1" 404 1629
**.***.*.163 - - [03/Nov/2012:12:59:37 +0000] "GET /youjizz/a.php?config=hardcore-porn/TokyoHot0370/video42732?ref=bw HTTP/1.1" 404 1627
***.***.**.95 - - [03/Nov/2012:12:59:38 +0000] "GET /favicon.ico HTTP/1.1" 404 1002
***.***.***.108 - - [03/Nov/2012:12:59:44 +0000] "GET /youjizz/a.php?config=teen-porn/Aaralyn-Barra-interracial-DP/video294307 HTTP/1.1" 404 1629
***.***.***.108 - - [03/Nov/2012:12:59:45 +0000] "GET /favicon.ico HTTP/1.1" 404 1002
***.***.***.108 - - [03/Nov/2012:12:59:47 +0000] "GET /youjizz/a.php?config=blowjob-videos/Penocchio/video118230 HTTP/1.1" 404 1629
***.***.***.108 - - [03/Nov/2012:12:59:47 +0000] "GET /favicon.ico HTTP/1.1" 404 1002
***.***.***.108 - - [03/Nov/2012:12:59:50 +0000] "GET /youjizz/a.php?config=group-sex/Kosziv/video118717 HTTP/1.1" 404 1629
**.***.*.163 - - [03/Nov/2012:12:59:53 +0000] "GET /youjizz/a.php?config=hardcore-porn/Hot-Korean-Girl-Gets-Fucked/video59085?ref=bw HTTP/1.1" 404 1627
***.***.***.108 - - [03/Nov/2012:12:59:59 +0000] "GET /youjizz/a.php?config=hardcore-porn/TokyoHot0370/video42732?ref=bw HTTP/1.1" 404 1629
**.***.*.163 - - [03/Nov/2012:13:00:03 +0000] "GET /youjizz/a.php?config=hardcore-porn/Really-tight-and-skinny-asian-chick./video15788 HTTP/1.1" 404 1627
***.***.***.108 - - [03/Nov/2012:13:00:04 +0000] "GET /youjizz/a.php?config=anal-porn/Asian-appel-Angelina/video53882?ref=bw HTTP/1.1" 404 1629
***.***.***.108 - - [03/Nov/2012:13:00:07 +0000] "GET /youjizz/a.php?config=hardcore-porn/Asian-appel-Die/video54441?ref=bw HTTP/1.1" 404 1629
**.***.*.163 - - [03/Nov/2012:13:00:09 +0000] "GET /youjizz/a.php?config=hardcore-porn/Asian-appel-Die/video54441?ref=bw HTTP/1.1" 404 1627
**.***.*.163 - - [03/Nov/2012:13:00:10 +0000] "GET /favicon.ico HTTP/1.1" 404 1002
**.***.*.163 - - [03/Nov/2012:13:00:17 +0000] "GET /youjizz/a.php?config=hardcore-porn/IESP443/video51001 HTTP/1.1" 404 1627
**.***.*.163 - - [03/Nov/2012:13:00:26 +0000] "GET /youjizz/a.php?config=hardcore-porn/IESP443/video51001 HTTP/1.1" 404 1627
***.**.**.129 - - [03/Nov/2012:13:01:01 +0000] "GET /youjizz/a.php?config=hardcore-porn/%28no-sound%29-Initiations-DP/video80126flv&repeat=true&autostart=true&allowfullscreen=true&%20&autostart=true&logo HTTP/1.1" 404 1973
***.**.**.129 - - [03/Nov/2012:13:01:01 +0000] "GET /favicon.ico HTTP/1.1" 404 1002
***.***.***.10 - - [03/Nov/2012:13:01:25 +0000] "GET /favicon.ico HTTP/1.1" 404 1002
***.***.***.4 - - [03/Nov/2012:13:01:58 +0000] "GET /youjizz/a.php?config=hardcore-porn/TokyoHot0370/video42732?ref=bw HTTP/1.1" 404 1973
***.***.***.4 - - [03/Nov/2012:13:02:49 +0000] "-" 408 -
***.***.***34 - - [03/Nov/2012:13:04:33 +0000] "GET /favicon.ico HTTP/1.1" 404 1002
***.***.**.95 - - [03/Nov/2012:13:04:57 +0000] "GET /favicon.ico HTTP/1.1" 404 1002
***.***.**.53 - - [03/Nov/2012:13:06:12 +0000] "GET /oumeishipin/page_14.html HTTP/1.1" 404 998
**.***.**.202 - - [03/Nov/2012:13:07:04 +0000] "GET /user.php?config=BZidhVftYrgV HTTP/1.1" 404 1002
***.***.**.52 - - [03/Nov/2012:13:07:43 +0000] "GET /plus/comment/js.asp?id=46046 HTTP/1.1" 404 998
***.***.***34 - - [03/Nov/2012:13:08:21 +0000] "GET /favicon.ico HTTP/1.1" 404 1002
***.***.***.10 - - [03/Nov/2012:13:08:34 +0000] "GET /favicon.ico HTTP/1.1" 404 1002
**.***.***.152 - - [03/Nov/2012:13:08:51 +0000] "GET /favicon.ico HTTP/1.1" 404 1002
***.**.***.35 - - [03/Nov/2012:13:09:43 +0000] "GET /yazhoushipin/shen-feng-jian-ye-9051.html HTTP/1.1" 404 1002
***.**.***.35 - - [03/Nov/2012:13:10:05 +0000] "GET /yazhoushipin/sheng-she-ji-chun-cai-you-ma-16653.html HTTP/1.1" 404 1002
**.***.**.86 - - [03/Nov/2012:13:10:11 +0000] "GET /gbook.asp HTTP/1.1" 404 1002
***.**.***.35 - - [03/Nov/2012:13:10:17 +0000] "GET /qvod-juqing/gongqigongfu-huotuihuotui-gongyongfuqi.html HTTP/1.1" 404 1002
***.**.***.35 - - [03/Nov/2012:13:10:27 +0000] "GET /yazhoushipin/bei-nan-you-de-peng-you-bao-jiu-zai-hao-you-mian-qian-bei-qin-fan-you-ma-zhong-zi-mu-12919.html HTTP/1.1" 404 1002
***.**.***.35 - - [03/Nov/2012:13:10:39 +0000] "GET /qvod-yazhou/ETC83-gong-%A5%DA-%A5%B0%A5%AC-yiyuxiang.html HTTP/1.1" 404 1002
***.**.***.35 - - [03/Nov/2012:13:10:49 +0000] "GET /qvod-oumei/Sorry-Daddy-Whitezilla-Broke-My-Little-Pussy_797466d8.html HTTP/1.1" 404 1002
***.***.**.6 - - [03/Nov/2012:13:10:50 +0000] "GET /favicon.ico HTTP/1.1" 404 1002
***.**.***.35 - - [03/Nov/2012:13:10:59 +0000] "GET /oumeishipin/jin-fa-piao-liang-mei-nv-wan-shuang-cha-3-P.html HTTP/1.1" 404 1002
***.***.**.188 - - [03/Nov/2012:13:11:05 +0000] "GET /yazhoushipin/xin-you-hua-gui-xu-2-you-ma.html HTTP/1.1" 404 1002
***.***.**.90 - - [03/Nov/2012:13:11:07 +0000] "GET /qvod-oumei/ HTTP/1.1" 404 998
***.**.***.35 - - [03/Nov/2012:13:11:36 +0000] "GET /yazhoushipin/O-L-zi-1-you-ma-10135.html HTTP/1.1" 404 1002
***.***.**.90 - - [03/Nov/2012:13:11:38 +0000] "GET /qvod-yazhou/### HTTP/1.1" 404 998
***.**.***.35 - - [03/Nov/2012:13:11:53 +0000] "GET /qvod-oumei/Timo-deririyeye-B.html HTTP/1.1" 404 1002
***.**.***.35 - - [03/Nov/2012:13:12:03 +0000] "GET /qvod-yazhou/EC118-mo.html HTTP/1.1" 404 1002
***.***.**.252 - - [03/Nov/2012:13:12:09 +0000] "GET /youjizz/a.php?config=teen-porn/Kyle-Fucks-and-Eats-Cum-from-15-men/video10609 HTTP/1.0" 404 998
***.**.***.35 - - [03/Nov/2012:13:12:13 +0000] "GET /qvod-oumei/FuckSlaves-xingnu-4-quanji.html HTTP/1.1" 404 1002
***.**.***.35 - - [03/Nov/2012:13:12:23 +0000] "GET /qvod-dongman/yinmo-2-quanji.html HTTP/1.1" 404 1002

What could this be about? Webalizer is also showing a high amount of traffic, much more than I'd expect for my site.

webalizer screenshot

Any help would be appreciated.. The site has only been up for a couple of weeks, and none of the IPs match members on my forum.

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

It surely looks like many broken URLs and not something malicious in nature. My best guess is that you've recently purchased this new server and the IP that is assigned to you was previously owned by someone hosting adult websites.

share|improve this answer
    
This is the only explanation I could think of too. Is it likely that this will go on, or could it just be a problem with some nameservers not having updated yet? –  Nysepho Nov 3 '12 at 14:16
    
This may go on for a while until all the broken links are removed from various portal sites. You can even look for patterns and write some rewrite rules to divert traffic to your home page for higher page hits. It it highly likely that the DNS a records for the previously hosted adult sites are still pointing to your IP. This will surely not harm you in anyway and you may think about profiting by it in a way I mentioned above. –  toxboi Nov 3 '12 at 14:38
    
That seems like a great idea - redirecting traffic to my home page. I think I'll go work on that now. Thanks for your help, maybe it's not so bad after all! –  Nysepho Nov 3 '12 at 14:45
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.