Mister Denial Posted September 17, 2013 Share Posted September 17, 2013 (edited) Hello, while examining my error log I noticed a huge list of errors, the same IP trying to access a long list of files not available on my website. I am now worried and unsure whether this is an aggressive form of spidering by Baidu, or if it is a hacking attempt by an IP posing as Baidu. What should I do about this? Thanks in advance for your help! Dan Sample from error.log - the full log has dozens and dozens of lines! [Tue Sep 17 09:02:21 2013] [error] [client 183.60.244.49] File does not exist: /home/domain/public_html/docs.css, referer: http://www.baidu.com [Tue Sep 17 09:02:17 2013] [error] [client 183.60.244.49] File does not exist: /home/domain/public_html/editor, referer: http://www.baidu.com [Tue Sep 17 09:02:17 2013] [error] [client 183.60.244.49] File does not exist: /home/domain/public_html/phpmyadmin, referer: http://www.baidu.com [Tue Sep 17 09:02:17 2013] [error] [client 183.60.244.49] File does not exist: /home/domain/public_html/editor, referer: http://www.baidu.com [Tue Sep 17 09:02:16 2013] [error] [client 183.60.244.49] File does not exist: /home/domain/public_html/ChangeLog, referer: http://www.baidu.com [Tue Sep 17 09:02:16 2013] [error] [client 183.60.244.49] File does not exist: /home/domain/public_html/Documentation.txt, referer: http://www.baidu.com [Tue Sep 17 09:02:15 2013] [error] [client 183.60.244.49] File does not exist: /home/domain/public_html/Scripts, referer: http://www.baidu.com [Tue Sep 17 09:02:14 2013] [error] [client 183.60.244.49] File does not exist: /home/domain/public_html/Help, referer: http://www.baidu.com [Tue Sep 17 09:02:14 2013] [error] [client 183.60.244.49] File does not exist: /home/domain/public_html/templates, referer: http://www.baidu.com [Tue Sep 17 09:02:14 2013] [error] [client 183.60.244.49] File does not exist: /home/domain/public_html/board, referer: http://www.baidu.com [Tue Sep 17 09:02:13 2013] [error] [client 183.60.244.49] File does not exist: /home/domain/public_html/install, referer: http://www.baidu.com [Tue Sep 17 09:02:13 2013] [error] [client 183.60.244.49] File does not exist: /home/domain/public_html/cuteeditor_files, referer: http://www.baidu.com [Tue Sep 17 09:02:13 2013] [error] [client 183.60.244.49] File does not exist: /home/domain/public_html/phpmyadmin, referer: http://www.baidu.com [Tue Sep 17 09:02:12 2013] [error] [client 183.60.244.49] File does not exist: /home/domain/public_html/phpmyadmin, referer: http://www.baidu.com Edited October 21, 2013 by Mister Denial (see edit history) Link to comment Share on other sites More sharing options...
vekia Posted September 17, 2013 Share Posted September 17, 2013 it's probably robot created by hackers, if these directories will exist, then this robot will try to log in, post some data etc. Link to comment Share on other sites More sharing options...
Mister Denial Posted September 17, 2013 Author Share Posted September 17, 2013 Thanks for the info vekia, I am really a bit worried. What can or should I do about it? Blocking their IP? Any recommendations? I'm on PS 1.4.9 Link to comment Share on other sites More sharing options...
vekia Posted September 17, 2013 Share Posted September 17, 2013 Unfortunately, you can not hide from the robots at all, they can change IP addresses without any problems... but of course if you are able to block ip addresses - block them! and use non default names of directories, for example instead of "phpmyadmin" use "myawesomephpmyadmin" etc. This is why prestashop by default want to change name of "admin" and "install" directory to something other as long as you do not have these directories ([error] [client 183.60.244.49] File does not exist) - you don't have to worry. Link to comment Share on other sites More sharing options...
Mister Denial Posted September 17, 2013 Author Share Posted September 17, 2013 I think I should be able to google for a way to block the IP in htaccess - unless you have a code recommendation - I am on a VPS, so I should be able to put in place whatever it takes to block the IP. My install folder was deleted years ago, and the admin renamed, so I think I am safe on that end. I did check on the phpmyadmin folder, because I never renamed that one, by I actually could not see it at all in my public html. Nor can I actually find it in any of the server folders I have access to. So I guess I should be good, right? :-) Still a bit scary experience though. :-) And thanks again for your time and help, I really do appreciate. Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now