There's something really weird happening in my server.

But first things first: I wanted to have my website and chose the domain name "myowndomain.com", Now on my domain registrar I point "myowndomain.com" to the address of my recently setup VPS, let's say

So I installed everything I needed to run my website, and I started to notice strange queries coming from different IP Addresses.

Like these

[client] File does not exist: /var/www/html/api, referer: http://www.strangedomain.com/api/manyou/my.php
[client 456.456.456.456] File does not exist: /var/www/html/api, referer: http://www.strangedomain.com/api/manyou/my.php

or like this (Really a long line, I cut some things)

GET /?s=vod-show-id-22-area-%E5%85%B6%E4%BB%96-language-%E9%9F%A9%E8%AF%AD.html HTTP/1.1" 301 295 "http://v.strangedomain.com/?s=vod-s ...[cut]... spider"

That above is happening the most.

The 'strangedomain.com' returns the same IP address of my VPS which my website is hosted on. The whois of such domain shows it's registered to a chinese. But the street name didn't look so right (like a huge single word), so I think all of that info might be fake, but still might be a chinese. I also noticed that all 'clients' trying to access the 'strangedomain.com' is coming from china.

If I type in the browser 'strangedomain.com', I see my website.

I'm worried, because my website is actually an e-commerce. I don't know if 'strangedomain.com' WAS a website on in the not so far past, or if it's something else.


Welcome to the Internet. You will see all kinds of random junk all the time and you will always wonder whether it's an attack or just random junk. There's no shortcut. You need to investigate each case and make an intelligent determination.

If you're not qualified to do this, why are you the server administrator?

  • can we have this as some kind of answer-template? – that guy from over there Nov 3 '13 at 8:44
  • I can use my second IP Address, start banning all china clients who tries to access the current ip. You didn't say what 'intelligent determination' could be. – Mike Chip Nov 3 '13 at 11:36
  • David can't possibly teach you how to distinguish between log file junk and genuine attack attempts in an SF answer; it is a vast, complex, and rapidly-evolving field. The true value of his answer, as written, is in the last sentence, and you would do well to heed it. – MadHatter Nov 4 '13 at 16:26

I'm not quite sure what to address as it's a fairly broad question but for the last part of question you could see how recent 'strangedomain.com' is by looking at the whois record for it and seeing the registration date. If you didn't want your website to be accessed through this URL you could configure your vhosts file so that it's only accessible via "myowndomain.com".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.