Forum Moderators: phranque

Message Too Old, No Replies

Error messages on my server

         

Digmen1

12:26 am on May 21, 2020 (gmt 0)

10+ Year Member Top Contributors Of The Month



Hi
Not sure if this is the best place for this
I have a Xenforo forum with a hand coded website attached
I am gettig lots of error messages on my web-hoster similar to this one

2020-05-20 13:40:50 UTC [apache][core:info] [pid 14664] [client 107.180.91.27:56290] AH00128: File does not exist: /home/u1-tp4zr2haryf8/www/example.com/public_html/site/wp-admin/setup-config.php

It looks like they are looking fot Word Press - I do'nt have Word Press
Do you think it's a earch engine looking or a person looking for site to spam or scam.

Thanks


[edited by: not2easy at 12:33 am (utc) on May 21, 2020]
[edit reason] exemplified/privacy [/edit]

phranque

12:44 am on May 21, 2020 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



2020-05-20 13:40:50 UTC [apache][core:info] [pid 14664] [client 107.180.91.27:56290] AH00128: File does not exist: /home/u1-tp4zr2haryf8/www/example.com/public_html/site/wp-admin/setup-config.php

i would look for clues (user agent) in the corresponding entry in the web server access log file.

not2easy

12:46 am on May 21, 2020 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



More likely to be a scripted bot seeking weak or vulnerable security. The IP is not a telecom service provider. A lookup shows it belongs to godaddy (hosting). There are probably a million or more similar hits every day on sites all over the world. IF the bot is maintained they will eventually stop looking for wp- related files on your servers. They will be replaced by the next wave of automated visitors.

you can ignore them or learn to manage unwanted traffic. Or you can sign on with services like Cloudflare that keep them away from your host.

lucy24

12:51 am on May 21, 2020 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month



Always look at access logs before proceeding to error logs. If these are external requests for nonexistent files, you’re dealing with run-of-the-mill malign robots who can be handled in a variety of ways. If, on the other hand, these are internal requests, then somethng more complicated is going on.

You’re not really supposed to cite to-the-last-digit IPs, but since you accidentally did, I looked it up. 107.180.0.0/17 (107.180.0-127) is GoDaddy, so yeah, that could easily be an unwanted robot.

phranque

4:13 am on May 21, 2020 (gmt 0)

WebmasterWorld Administrator 10+ Year Member Top Contributors Of The Month



run-of-the-mill malign robots who can be handled in a variety of ways

you can start here:
Search Engine Spider and User Agent Identification [webmasterworld.com] forum
or more specifically here:
Blocking Methods [webmasterworld.com]