📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!

Apache And Dir Scan

pcombo
pcombo Posts: 3,429 Forumite
in Techie Stuff
Ok basically after checking my access log files for apache im seeing like a possible attack.

213.100.58.253 - - [11/Jan/2010:13:39:10 +0100] "GET /Lost%20-%20Complete%20Season%202%20%5bHDTV%5d%5bXviD%5d/Lost%20-%20s2e10%20%5bHDTV%5d%5bXviD%5d.avi HTTP/1.1" 404 265

No this file has never existed on my server so im not sure whats happening does anyone have any advice on how to stop these scans.

Comments

  • Lil306
    Lil306 Posts: 1,692
    Part of the Furniture 1,000 Posts Name Dropper Combo Breaker
    Forumite
    Not sure, but that IP range is Sweden. Could it some form of bot / spider. I believe apache has a section where you can stop bots browsing your site?

    The file doesn't exist, but it could be a bot doing a scan of all HTTP sites to see if that file exists perhaps?
    Owner of andrewhope.co.uk, hate cars and love them

    Working towards DFD

    HSBC Credit Card - £2700 / £7500
    AA Loans - (cleared £9700)
  • Lil306
    Lil306 Posts: 1,692
    Part of the Furniture 1,000 Posts Name Dropper Combo Breaker
    Forumite
    Just done a quick google search and it looks if it's possibly the right track. If you say that doesn't exist on your server, it's most likely a bot or web crawler

    You can work on building a robots.txt file for them to scan.

    I've found this post which may be useful for you aswell, it details on how to stop them and a list of all currently known bad bots. Given that it's a movie it's probably a bot for a P2P / Torrent site

    http://www.forumpostersunion.com/showthread.php?t=1644
    Owner of andrewhope.co.uk, hate cars and love them

    Working towards DFD

    HSBC Credit Card - £2700 / £7500
    AA Loans - (cleared £9700)
  • pcombo
    pcombo Posts: 3,429 Forumite
    cool thank you.
  • mr_fishbulb
    mr_fishbulb Posts: 5,224
    Part of the Furniture Combo Breaker
    Forumite
    pcombo wrote: »
    Ok basically after checking my access log files for apache im seeing like a possible attack.

    213.100.58.253 - - [11/Jan/2010:13:39:10 +0100] "GET /Lost%20-%20Complete%20Season%202%20%5bHDTV%5d%5bXviD%5d/Lost%20-%20s2e10%20%5bHDTV%5d%5bXviD%5d.avi HTTP/1.1" 404 265

    No this file has never existed on my server so im not sure whats happening does anyone have any advice on how to stop these scans.
    Hahaha Get Lost!

    How many other requests do you have from that IP address?
  • pcombo
    pcombo Posts: 3,429 Forumite
    213.100.58.253 - - [11/Jan/2010:13:48:48 +0100] "GET /Lost%20-%20Complete%20Season%202%20%5bHDTV%5d%5bXviD%5d/Lost%20-%20s2e11%20%5bHDTV%5d%5bXviD%5d.avi HTTP/1.1" 404 265
    78.167.168.84 - - [11/Jan/2010:14:00:52 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E01.HDTV.avi HTTP/1.1" 404 262
    78.167.168.84 - - [11/Jan/2010:14:00:52 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E03.HDTV.XviD.avi HTTP/1.1" 404 267
    78.167.168.84 - - [11/Jan/2010:14:00:53 +0100] "GET /Lost Season [4] S04E01to S04E13-14 complete/Lost.S04E03.HDTV.XviD.avi HTTP/1.1" 404 202
    78.167.168.84 - - [11/Jan/2010:14:00:53 +0100] "GET /Lost Season [4] S04E01to S04E13-14 complete/Lost.S04E01.HDTV.avi HTTP/1.1" 404 202
    78.167.168.84 - - [11/Jan/2010:14:00:53 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E01.HDTV.avi HTTP/1.1" 404 262
    78.167.168.84 - - [11/Jan/2010:14:00:53 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E03.HDTV.XviD.avi HTTP/1.1" 404 267
    78.167.168.84 - - [11/Jan/2010:14:01:04 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E05.HDTV.XviD.avi HTTP/1.1" 404 267
    78.167.168.84 - - [11/Jan/2010:14:01:04 +0100] "GET /Lost Season [4] S04E01to S04E13-14 complete/Lost.S04E05.HDTV.XviD.avi HTTP/1.1" 404 202
    78.167.168.84 - - [11/Jan/2010:14:01:04 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E05.HDTV.XviD.avi HTTP/1.1" 404 267
    78.167.168.84 - - [11/Jan/2010:14:01:13 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E06.The_Other_Woman..avi HTTP/1.1" 404 274
    78.167.168.84 - - [11/Jan/2010:14:01:13 +0100] "GET /Lost Season [4] S04E01to S04E13-14 complete/Lost.S04E06.The_Other_Woman..avi HTTP/1.1" 404 202
    78.167.168.84 - - [11/Jan/2010:14:01:13 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E06.The_Other_Woman..avi HTTP/1.1" 404 274
    78.167.168.84 - - [11/Jan/2010:14:01:17 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E08.HDTV.XViD.avi HTTP/1.1" 404 267
    78.167.168.84 - - [11/Jan/2010:14:01:17 +0100] "GET /Lost Season [4] S04E01to S04E13-14 complete/Lost.S04E08.HDTV.XViD.avi HTTP/1.1" 404 202
    78.167.168.84 - - [11/Jan/2010:14:01:17 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E08.HDTV.XViD.avi HTTP/1.1" 404 267
    78.167.168.84 - - [11/Jan/2010:14:01:27 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E02.HDTV..avi HTTP/1.1" 404 263
    78.167.168.84 - - [11/Jan/2010:14:01:27 +0100] "GET /Lost Season [4] S04E01to S04E13-14 complete/Lost.S04E02.HDTV..avi HTTP/1.1" 404 202
    78.167.168.84 - - [11/Jan/2010:14:01:27 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E02.HDTV..avi HTTP/1.1" 404 263
    80.167.173.207 - - [11/Jan/2010:14:01:27 +0100] "GET / HTTP/1.1" 200 3001
    78.167.168.84 - - [11/Jan/2010:14:01:29 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E11.HDTV.avi HTTP/1.1" 404 262
    78.167.168.84 - - [11/Jan/2010:14:01:29 +0100] "GET /Lost Season [4] S04E01to S04E13-14 complete/Lost.S04E11.HDTV.avi HTTP/1.1" 404 202
    78.167.168.84 - - [11/Jan/2010:14:01:29 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E11.HDTV.avi HTTP/1.1" 404 262
    80.167.173.207 - - [11/Jan/2010:14:01:30 +0100] "GET /favicon.ico HTTP/1.1" 404 209
    78.167.168.84 - - [11/Jan/2010:14:01:30 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E09.HDTV.XviD.avi HTTP/1.1" 404 267
    78.167.168.84 - - [11/Jan/2010:14:01:30 +0100] "GET /Lost Season [4] S04E01to S04E13-14 complete/Lost.S04E09.HDTV.XviD.avi HTTP/1.1" 404 202
    78.167.168.84 - - [11/Jan/2010:14:01:30 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E09.HDTV.XviD.avi HTTP/1.1" 404 267
    78.167.168.84 - - [11/Jan/2010:14:01:32 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost%20S04E12.HDTV.avi HTTP/1.1" 404 262
    78.167.168.84 - - [11/Jan/2010:14:01:32 +0100] "GET /Lost Season [4] S04E01to S04E13-14 complete/Lost S04E12.HDTV.avi HTTP/1.1" 404 202
    78.167.168.84 - - [11/Jan/2010:14:01:32 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost%20S04E12.HDTV.avi HTTP/1.1" 404 262
    80.167.173.207 - - [11/Jan/2010:14:01:33 +0100] "GET /favicon.ico HTTP/1.1" 404 209
    78.167.168.84 - - [11/Jan/2010:14:02:00 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E07.HDTV..avi HTTP/1.1" 404 263
    78.167.168.84 - - [11/Jan/2010:14:02:01 +0100] "GET /Lost Season [4] S04E01to S04E13-14 complete/Lost.S04E07.HDTV..avi HTTP/1.1" 404 202
    78.167.168.84 - - [11/Jan/2010:14:02:01 +0100] "GET /Lost%20Season%20%5b4%5d%20S04E01to%20S04E13-14%20complete/Lost.S04E07.HDTV..avi HTTP/1.1" 404 263



    Quite alot lol.
  • Ximian
    Ximian Posts: 711
    Part of the Furniture 500 Posts Combo Breaker
    Forumite
    edited 11 January 2010 at 4:42PM
    The source IP address 78.167.168.84 is in Turkey (Turk Telekom), you could always block the address: http://httpd.apache.org/docs/2.2/howto/access.html
  • pcombo
    pcombo Posts: 3,429 Forumite
    blocking the ip wont stop the search it will only stop a user from viewing the website.
  • davb
    davb Posts: 1,293
    Part of the Furniture Combo Breaker
    Forumite
    pcombo wrote: »
    No this file has never existed on my server so im not sure whats happening does anyone have any advice on how to stop these scans.
    Have you checked? It's not uncommon for sites to get hacked, and then set up as download servers for all sorts of things :eek:
  • pcombo
    pcombo Posts: 3,429 Forumite
    nah, i seem to get it on all my 1and1 servers with apache installed.
  • Lil306
    Lil306 Posts: 1,692
    Part of the Furniture 1,000 Posts Name Dropper Combo Breaker
    Forumite
    It's more than likely a bot / crawler searching for content. pcombo needs to create a robots.txt file which should alleviate the crap

    Actually so should I.... :D
    Owner of andrewhope.co.uk, hate cars and love them

    Working towards DFD

    HSBC Credit Card - £2700 / £7500
    AA Loans - (cleared £9700)
This discussion has been closed.
★ ★ ★ Meet your Ambassadors

🚀 Getting Started

Hi new member!

Our Getting Started Guide will help you get the most out of the Forum

Categories

  • All Categories
  • 355.9K Banking & Borrowing
  • 255K Reduce Debt & Boost Income
  • 456.2K Spending & Discounts
  • 248.4K Work, Benefits & Business
  • 606.1K Mortgages, Homes & Bills
  • 179K Life & Family
  • 263.9K Travel & Transport
  • 1.5M Hobbies & Leisure
  • 16.2K Discuss & Feedback
  • 37.7K Read-Only Boards

Is this how you want to be seen?

We see you are using a default avatar. It takes only a few seconds to pick a picture.
Update Your Picture