I checked the error_log today and found this suspicious:

    [Mon Nov 27 01:18:36 2011] [error] [client omitted] 
    File does not exist: /var/www/domain.com/htdocs/robots.txt
    [Mon Nov 27 01:18:45 2011] [error] [client omitted] 
    File does not exist: /var/www/domain.com/htdocs/robots.txt
    [Mon Nov 27 01:24:38 2011] [error] [client ommited] 
    script '/var/www/domain.com/htdocs/proxy-1.php' 
    not found or unable to stat
    [Mon Nov 27 01:24:57 2011] [error] [client omitted] 
    script '/var/www/domain.com/htdocs/judge112233.php' 
    not found or unable to stat

And I say suspicious because I am the only person using the site right now, so I know all the pages and I would never access those pages above. So is this a bot attack?

  • @jamewaffles sorry will think about it before posting.
    – Sam Khan
    Nov 28, 2011 at 19:33
  • No problem. Just some advice for future reference :-)
    – Bojangles
    Nov 28, 2011 at 19:35
  • 3
    FYI, these are very common. They are of no concern... just bots looking for scripts that may have been uploaded to your server for remote control. You only need to be concerned if any of these requests succeed.
    – Brad
    Nov 28, 2011 at 19:36

4 Answers 4


Looks more like a web crawler to me.

  • this is the first time i have seen this so i have been panicking. what does that mean?
    – Sam Khan
    Nov 28, 2011 at 19:32
  • 2
    Normally it means that Google is looking through your site, adding the pages to its index. Of course, it could be other search engines. Try looking up the IP address and/or the User-Agent header.
    – Tom van der Woerdt
    Nov 28, 2011 at 19:34
  • this is one the IPs:
    – Sam Khan
    Nov 28, 2011 at 19:37
  • 1
    That IP is a bad IP. ipillion.com/ip/ does not look too legit. Nov 28, 2011 at 19:46

The 2 first could be a crawler for search engines attempting to get data from robots.txt


If you're looking at useragent, it's good to check the IPs you find as well. I've sen DOS attacks with spoofed googleBot useragent headers. the version 6.66 kinda gave it away, but it didn't have to.


Reading some of those comments on ipmillion found this:

 These machines are not Hackers/Crackers at all,they have merely been 
 Compromised.A scan of several of these ip blocks reveals that the 
 Machines are not Fire walled or running any kind of Security.
 They have basically been hijacked and are now being used as D
rones,ie BOTNETS. As for the people who have Compromised them!! 
They could be any were in the World.

So i guess you have nothing to worry about.