4

So I don't get whats with all these error messages. I was told someone may be attempting to hack my server, but I ain't 100% sure whats going on.

I am running CentOs 6.

Here is a list of errors that I have gotten:

P.S NONE OF THESE IP'S ARE MINE

[Mon Dec 09 12:36:27 2013] [error] [client 216.121.127.194] script not found or unable to stat: /var/www/cgi-bin/php
[Mon Dec 09 12:36:27 2013] [error] [client 216.121.127.194] script not found or unable to stat: /var/www/cgi-bin/php
[Tue Dec 10 04:39:32 2013] [error] [client 202.162.221.227] script not found or unable to stat: /var/www/cgi-bin/php
[Tue Dec 10 05:50:07 2013] [error] [client 67.228.121.194] script not found or unable to stat: /var/www/cgi-bin/php
[Tue Dec 10 07:11:23 2013] [error] [client 119.52.254.20] client denied by server configuration: /usr/share/phpMyAdmin/scripts
[Tue Dec 10 07:11:24 2013] [error] [client 119.52.254.20] client denied by server configuration: /usr/share/phpMyAdmin/scripts
[Tue Dec 10 08:51:36 2013] [error] [client 58.241.10.22] client denied by server configuration: /usr/share/phpMyAdmin/scripts
[Tue Dec 10 08:51:37 2013] [error] [client 58.241.10.22] client denied by server configuration: /usr/share/phpMyAdmin/scripts
[Thu Dec 12 03:34:41 2013] [error] [client 46.229.157.226] script not found or unable to stat: /var/www/cgi-bin/php
[Thu Dec 12 03:34:42 2013] [error] [client 46.229.157.226] script not found or unable to stat: /var/www/cgi-bin/php5
[Thu Dec 12 03:34:42 2013] [error] [client 46.229.157.226] script not found or unable to stat: /var/www/cgi-bin/php-cgi
[Thu Dec 12 03:34:42 2013] [error] [client 46.229.157.226] script not found or unable to stat: /var/www/cgi-bin/php.cgi
[Thu Dec 12 03:34:43 2013] [error] [client 46.229.157.226] script not found or unable to stat: /var/www/cgi-bin/php4
[Thu Dec 12 05:10:38 2013] [error] [client 89.248.160.192] Invalid URI in request GET HTTP/1.1 HTTP/1.1
[Thu Dec 12 05:10:39 2013] [error] [client 89.248.160.192] script not found or unable to stat: /var/www/cgi-bin/php
[Thu Dec 12 05:10:39 2013] [error] [client 89.248.160.192] script not found or unable to stat: /var/www/cgi-bin/php4
[Thu Dec 12 05:10:39 2013] [error] [client 89.248.160.192] script not found or unable to stat: /var/www/cgi-bin/php5
[Thu Dec 12 05:10:39 2013] [error] [client 89.248.160.192] script not found or unable to stat: /var/www/cgi-bin/php-cgi
[Thu Dec 12 05:10:40 2013] [error] [client 89.248.160.192] script not found or unable to stat: /var/www/cgi-bin/php.cgi

EDIT:

Some PHP code for the .htaccess file to block some scanners.

RewriteCond %{HTTP_USER_AGENT} ^w3af.sourceforge.net [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} dirbuster [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} nikto [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} SF [OR] 
RewriteCond %{HTTP_USER_AGENT} sqlmap [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} fimap [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} nessus [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} whatweb [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} Openvas [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} jbrofuzz [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} libwhisker [NC,OR] 
RewriteCond %{HTTP_USER_AGENT} webshag [NC,OR] 
RewriteCond %{HTTP:Acunetix-Product} ^WVS 

Make sure this is placed in the category.

If it isn't just do <IfModule mod_rewrite.c>paste content here</IfModule>

1 Answer 1

5

Most of these resolve into Web crawlers. For instance 58.241.10.22 is from from China

Pretty harmless IMHO.

1
  • 2
    A buddy of mine is extremely advanced in security etc, gave me some code for my htaccess to block my site from being scanned. Apparently one of the scanners were a w00t w00t foot print.
    – user202098
    Dec 12, 2013 at 6:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .