I was looking through the 404 errors of my nginx logs today to see what the hackers are trying to do on my website.

I usued this command:

cat access.log | grep '404'

I saw the usual requests for directories like "/admin.", "/backup/", or "/private/" but I also see a few requests like these:

"GET /yatjgmatiak/ HTTP/1.1"

"GET /gkjasdhytkaf/ HTTP/1.1"

"GET /ukaewlinfsda/ HTTP/1.1"

"GET /vankhasgeskl/ HTTP/1.1"

There aren't that many of them (only about 50 total requests) so if it were a brute force attempt at trying to find an admin panel, it would be a poor one.

What do you think these hackers are looking for or trying to do?

  • 1
    Possibly searching for directories infected by their (or others) malware. So they would already have a php and/or other script/executable planted on the system and they would then control that system after they get a hit. Or they could just be trying to scan for temporary files left by certain types of software. – Miuku May 11 at 4:39
  • Oh that makes sense. Maybe they tried an exploit that creates a file or directory and they are checking to see if that file exists? If that file exists, it must mean their exploit worked? – hexagonponytail May 11 at 5:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.