1

I have setup a small tiny VPS for my own website. Since it was live, I see many suspicious activity in the access.log file. When I was on a shared hosting I did not have access to this file and therefore unaware of it.

I want to know are these stuff dangerous, and if I need to take action, where do I begin? here goes some samples: Specially the first one, I do not understand what that user wanted to achieve!

[Mon Feb 01 14:11:07.488860 2016] [core:error] [pid 30683] [client 169.229.3.91:46137] AH00135: Invalid method in request V\xd8}\x97\x97\xd1\x19\x01\xf4\xaf\x9ag\xa9'\x82h5\xb6\xc5\x84\x8a\x8b(\xd8\x97\xfeJ\xd6\xd6\x1e\xa3\x88\xb0\xfb.\xad\xcd{\xdf\x96"\xcfK\x8aU\x9b\xb8T\xf2

[Mon Feb 01 08:40:14.268487 2016] [:error] [pid 1214] [client 95.213.177.124:24875] script '/var/www/html/azenv.php' not found or unable to stat, referer: https://proxyradar.com/

[Tue Feb 02 15:08:57.247512 2016] [:error] [pid 3346] [client 52.33.93.45:65203] script '/var/www/html/wp-login.php' not found or unable to stat

2

This is probably just https://en.wikipedia.org/wiki/Internet_background_noise , aka automated scripts looking for vulnerabilities of unpatched servers.

You might want to setup a WAF like ModSecurity and have it IP-block suspicious requests.

Patch your server regularly.

0

A list of all errors present in the Apache webserver is available here: Apache ListOfErrors

Your logfile entry with AH00135: Invalid method in request %s can be caused by telnet sessions (possible input error), proxy server (possible config error), intrusion attempts and others.

To deal automated with possible malicious Apache requests I highly recommend fail2ban.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.