Strange entries in log files

Accessing files/pages that dont even exists

[Andre123]

Hi all,

Not sure if this is the right place to ask this question - apologies if it's not.

I notice on my logfiles that pages are accessed that do not even exist. Funny things like wwWebmasterWorldebsite.com/StrangeDirectory/StrangeSubDirectory/PageThatDoesNotExist.

Obviously a 404 error is then created, but why/how are these pages even accessed.

Hope to hear from you soon.

thanks
Webbo

[dataKris]

Andre,

Its very likely that some bot is scanning Ur site for potential weak spots.. and since they are not there, U might be seeing entries in the error log.. its good U don't have those files..

out of curiosity, what OS & web server are U running?

[Andre123]

Hi and thanks for the reply.

What do you mean by "weak spots"? Trying to hack into my site or something like that?

I'm using Redhat Linux as my web server. Funnily enough I have noticed a dramatic decrease in hits to my website!?!?!?

[dataKris]

Andre,

The log file shows that some one is probing for some files.. I would search for the files found in the error log on google and that may throw light on how those have been used to exploit.

I was running apache web server on a windows OS and found several probes in my error log for IIS and related files.. indeed potential holes to hack into your site.

All this means that you just need to keep checking your logs.. cannot say if a hack has caused the reduction in your traffic though.

[balam]

Hi Andre123...

If the requests are being made by the Yahoo! Slurp robot, then you should take a look at this thread [webmasterworld.com] (and follow the links to the other threads you'll find).

[Andre123]

Hi all, thanks for the help so far....

Here are 2 entries which I see pretty frequently -

public_html/MSOffice/cltreq.asp
public_html/_vti_bin/owssvr.dll

Any ideas what they are?

[bcolflesh]

It's the Discussion button in IE querying the site - ignore it.

[stef25]

i got requests for scripts that were never on my site, things like eforms.cgi, eform.pl etc

i posted the ip's in an earlier thread and brett replied that these were compromised machines looking for weak scripts / with holes in

if they show up in your error log that means they are not on your server so you have nothing to worry about

you could block the ip