indix.html and 405's in error log ?

[nmjudy]

Can anyone tell me if this looks like these entries could be doing something with Adsense invalid activity? My error logs shows indix.html as a 405 error, however a small snippet of my raw log files are listed below.

There is no indix.html file on my site, so it's suspicious that it would be called a gazillion times a day from hundreds of ips:

63.164.47.9 - - [30/Sep/2013:17:13:10 -0400] "GET /indix.html HTTP/1.1" 301 251 "-" "Mangoway"
63.164.47.9 - - [30/Sep/2013:17:13:11 -0400] "GET /indix.html HTTP/1.1" 404 5300 "-" "Mangoway"
206.228.98.3 - - [30/Sep/2013:17:13:24 -0400] "GET /indix.html HTTP/1.1" 301 251 "-" "Mangoway"
206.228.98.3 - - [30/Sep/2013:17:13:24 -0400] "GET /indix.html HTTP/1.1" 404 5300 "-" "Mangoway"
70.107.228.174 - - [30/Sep/2013:17:29:38 -0400] "GET /indix.html HTTP/1.1" 301 251 "-" "Mangoway"
70.107.228.174 - - [30/Sep/2013:17:29:38 -0400] "GET /indix.html HTTP/1.1" 404 5300 "-" "Mangoway"
72.234.49.46 - - [30/Sep/2013:17:53:42 -0400] "GET /indix.html HTTP/1.1" 301 251 "-" "Mangoway"
72.234.49.46 - - [30/Sep/2013:17:53:43 -0400] "GET /indix.html HTTP/1.1" 404 5300 "-" "Mangoway"

How would you interpret this?

[swa66]

405: that's not what your logs show.

301 line is a redirect.
404 is a not found error.

Your error_log probably has a bit more info than your access_log.

Now "Mangoway" smells like a bot unless your log isn't showing there the browser string...

[nmjudy]

Oops...the 405 error was something else. So maybe I have 2 issues.

Sorry - I'm drowning in raw logs. The 405 doesn't give ANY further information. Just this:
[Thu Oct 31 16:57:32 2013] [error] [client 38.103.208.252] File does not exist: /home/myusername/public_html/405.shtml
[Thu Oct 31 16:57:28 2013] [error] [client 38.103.208.252] File does not exist: /home/myusername/public_html/405.shtml

I blocked the IP with the 405 error and also blocked "Mangoway" as a user agent in my .htaccess file. I hope that works because there are a gazillion IP addresses being used - not a normal browser string. Very strange that something redirects to my site to a page not found about 3 times per minute. ?

[lucy24]

Why is it a 405 in the first place? I had to go look it up: Method Not Allowed. But here it sounds more as if you simply don't like the visitor's face. So why not a basic 403?

File does not exist: /home/myusername/public_html/405.shtml

Frankly this worries me more. Why is the server looking for 405.shtml? It's got nothing to do with the 405 as such. The error message implies that somewhere else you've said

ErrorDocument 405 /405.shtml

and then when the server encounters a 405 error and goes looking for the document "405.shtml" it can't find it.

For starters, check your typing. I noticed this post is in the AdSense forum and the subject line says "indix.html". OK, so there's nothing wrong with telling the server that this is how you choose to spell it-- but it's unusual enough that I have to wonder about typos along the way.

[nmjudy]

I have nothing in my .htaccess file that issues a 405 error. I had to look that up too. I'll check with my server people to see where/why the server is issuing that directive.

As far as the indix.html - none of MY pages are called indix.html - so my guess is that Mangoway is calling example.com/indix.html and my server redirects it to www.example.com/indix.html and issues a 404. There's no referrer.

This post is in the adsense forum because I'm trying to find something that resembles invalid click activity and I found both these things odd.

[lucy24]

As far as the indix.html - none of MY pages are called indix.html - so my guess is that Mangoway is calling example.com/indix.html and my server redirects it to www.example.com/indix.html and issues a 404. There's no referrer.

Whoops! I completely misread the original post. So it's their typo, not yours.

Do you have any ErrorDocument directives of your own? The happiest solution at this point would be discovering that the last time the host tweaked the software, they mistyped "405" instead of "404". Then everyone on the server would be getting this mistake! But an ErrorDocument statement in your own htaccess overrides a server-wide one. So you can simply put in a line of your own and see if the whole "405.shtml" issue goes away.

Your unwelcome visitor would be hard pressed to click on anything if they're not even arriving on a page :)

Is the offending IP blocked? The most recent logs should then show 403 instead of 404. There may or may not still be a preceding 301, depending on whether the domain-name redirect originates in the config file or in htaccess.

[netmeg]

Sounds like she's getting them on multiple IP numbers. I've never seen that particular string, and I did some searches and didn't find anything either, so you got me. You could try adding it to your robots.txt to see if that blocks it (but of course, badly behaved bots behave badly, and won't necessarily obey robots.txt)

[lucy24]

I've never seen that particular string

I also didn't recognize any of the IPs. Cursory lookup turns up assorted apparently human ranges: I get two Sprint/Embarq, one Verizon Online and a (maybe) Hawaiian Telcom. ymmv. Compromised machines?

A flat block on the UA string can't do any harm.

Now, technically you don't need to do anything at all: they're asking for a nonexistent page, so the most they'll ever get is a 404. A 403 might save a teeny tiny bit of server resources (because it never has to go look for the file). But in this case it's more about emotional satisfaction.