Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top - - [07/Aug/2013:21:29:25 +0000] "GET /HNAP1/ HTTP/1.1" 403 501 "*************" "Mozilla/4.0 (compatible; Opera/3.0; Windows 4.10) 3.51 [en]" - - [07/Aug/2013:21:57:26 +0000] "POST /%70%68%70%70%61%74%68/%70%68%70?%2D%64+%61%6C%6C%6F%77%5F%75%72%6C%5F%69%6E%63%6C%75%64%65%3D%6F%6E+%2D%64+%73%61%66%65%5F%6D%6F%64%65%3D%6F%66%66+%2D%64+%73%75%68%6F%73%69%6E%2E%73%69%6D%75%6C%61%74%69%6F%6E%3D%6F%6E+%2D%64+%64%69%73%61%62%6C%65%5F%66%75%6E%63%74%69%6F%6E%73%3D%22%22+%2D%64+%6F%70%65%6E%5F%62%61%73%65%64%69%72%3D%6E%6F%6E%65+%2D%64+%61%75%74%6F%5F%70%72%65%70%65%6E%64%5F%66%69%6C%65%3D%70%68%70%3A%2F%2F%69%6E%70%75%74+%2D%6E HTTP/1.1" 403 476 "-" "-" - - [08/Aug/2013:00:33:26 +0000] "GET /oly/hello.php?i=list&b=oly_living HTTP/1.1" 403 497 "-" "Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/5.0);(b:2600;c:INT-3360;l:09)" - - [08/Aug/2013:03:57:55 +0000] "GET HTTP/1.1" 403 533 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)" - - [08/Aug/2013:11:44:16 +0000] "HEAD / HTTP/1.1" 403 182 "" "Mozilla/4.0 (compatible; Netcraft Web Server Survey)"

This came out of apache2 access_log. I do not know what to make of this. Should I be concerned?

share|improve this question
up vote 1 down vote accepted

Yes, probably. That long string of data is an encoded URL. I decoded it for you at;

/phppath/php?-d allow_url_include=on -d safe_mode=off -d suhosin.simulation=on -d disable_functions="" -d open_basedir=none -d auto_prepend_file=php://input -n

Are you running Plesk?

share|improve this answer
no im stopping my server completely for this. – Gasim Aug 8 '13 at 18:39
i am not using plesk but going to download it right now for future. What should I do about the problem i have right now? Any sort of advice would be appreciated. – Gasim Aug 8 '13 at 18:41
If you aren't running Plesk, don't worry about it. It was a drive-by check to see if your server was vulnerable. Your server responded with 403, anyway. (Forbidden) – Aaron Copley Aug 8 '13 at 18:42
Why would you download Plesk now? For the future? Do you know what it is? – Aaron Copley Aug 8 '13 at 18:42
omg im stupid. I just read about it. i just freaked out that this got into my access.log and i thought they got something out of my webserver. – Gasim Aug 8 '13 at 18:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.