The server is kind of up – not yet open to the public but the bots know about it already. I always keep checking the error logs for such abnormalities.It helps a great deal if you clean all the warning messages your Application is throwing – this way the errors that come up in error logs are genuine and you can monitor your server better.
Wondering if I should invest some time in a script to have a look at these logs – see if a “file does not exist” error happens in error_log and then take the ip address and see what got accessed in access_log – to see if the system is compromised.
On the below code scroll to the right to see the bot’s probes.
[Mon Oct 20 01:39:29 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/README
[Mon Oct 20 01:39:29 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/horde
[Mon Oct 20 01:39:29 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/horde2
[Mon Oct 20 01:39:29 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/horde3
[Mon Oct 20 01:39:29 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/horde-3.0.5
[Mon Oct 20 01:39:30 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/horde-3.0.6
[Mon Oct 20 01:39:31 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/horde-3.0.7
[Mon Oct 20 01:39:31 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/horde-3.0.8
[Mon Oct 20 01:39:31 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/horde-3.0.9
[Mon Oct 20 01:39:31 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/mail
[Mon Oct 20 01:39:31 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/email
[Mon Oct 20 01:39:32 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/webmail
[Mon Oct 20 01:39:32 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/newmail
[Mon Oct 20 01:39:32 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/mails
[Mon Oct 20 01:39:32 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/mailz
[Mon Oct 20 01:46:35 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/cacti
[Mon Oct 20 01:46:35 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/stats
[Mon Oct 20 01:46:35 2008] [error] [client **.***.**.***] script '/home/*****/html/graph_image.php' not found or unable to stat
[Mon Oct 20 02:05:56 2008] [error] [client **.***.**.***] script '/home/*****/html/xmlrpc.php' not found or unable to stat
[Mon Oct 20 02:05:56 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/xmlrpc
[Mon Oct 20 02:05:56 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/xmlsrv
[Mon Oct 20 02:05:57 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/blog
[Mon Oct 20 02:05:57 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/drupal
[Mon Oct 20 02:05:57 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/community
[Mon Oct 20 02:05:58 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/blogs
[Mon Oct 20 02:05:58 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/blogs
[Mon Oct 20 02:05:58 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/blog
[Mon Oct 20 02:05:59 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/blogtest
[Mon Oct 20 02:05:59 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/b2
[Mon Oct 20 02:05:59 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/b2evo
[Mon Oct 20 02:05:59 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/wordpress
[Mon Oct 20 02:05:59 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/phpgroupware
home/*****/html/awstats.pl
[Mon Oct 20 02:27:17 2008] [error] [client **.***.**.***] script not found or unable to stat: /home/*****/cgi-bin/awstats.pl
[Mon Oct 20 02:27:17 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/scgi-bin
[Mon Oct 20 02:27:18 2008] [error] [client **.***.**.***] File does not exist: /var/www/html/awstats/awstats.pl
[Mon Oct 20 02:27:18 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/scgi-bin
[Mon Oct 20 02:27:19 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/cgi
[Mon Oct 20 02:27:19 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/scgi
[Mon Oct 20 02:27:19 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/scripts
[Mon Oct 20 02:27:20 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/scgi-bin
[Mon Oct 20 02:27:20 2008] [error] [client **.***.**.***] script not found or unable to stat: /home/*****/cgi-bin/stats
[Mon Oct 20 02:27:20 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/scgi-bin
[Mon Oct 20 02:27:20 2008] [error] [client **.***.**.***] File does not exist: /home/*****/html/stats
