Google bot search for non existant file.

Discussion in 'other security issues & news' started by kdu, Dec 21, 2012.

Thread Status:
Not open for further replies.
  1. kdu

    kdu Registered Member

    Joined:
    Dec 21, 2012
    Posts:
    4
    Location:
    Australia
    Hi all,

    this looks like a google bot search for a non existant file.

    66.249.76.194 - - [18/Dec/2012:11:04:39 +0000] "GET /en/forum/design-issues/84630-include-surveyid-and-qcodes HTTP/1.0" 404 1223 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"



    I was looking for 404 nasties like the ones I found below. A and B.


    A.

    146.185.18.82 - - [18/Dec/2012:16:08:10 +0000] "GET /modules/pm_advancedsearch4/js/uploadify/uploadify.css? HTTP/1.0" 404 1226 "-" "-"
    146.185.18.82 - - [18/Dec/2012:16:08:10 +0000] "GET /scripts/uploadify/uploadify.css? HTTP/1.0" 404 1226 "-" "-"
    146.185.18.82 - - [18/Dec/2012:16:08:13 +0000] "GET /js/jquery.uploadify-v2.1.0/uploadify.css? HTTP/1.0" 404 1226 "-" "-"

    146.185.18.82 - - [20/Dec/2012:00:48:51 +0000] "GET /files/uploadify/uploadify.css? HTTP/1.0" 404 1226 "-" "-"
    146.185.18.82 - - [20/Dec/2012:00:48:51 +0000] "GET /jquery.uploadify-v2.1.4/uploadify.css? HTTP/1.0" 404 1226 "-" "-"
    146.185.18.82 - - [20/Dec/2012:00:48:51 +0000] "GET /blog/wp-content/plugins/sintic_gallery/js/uploadify-2.1.4/uploadify.css? HTTP/1.0" 404 1226 "-" "-"

    146.185.18.82 - - [19/Dec/2012:16:33:10 +0000] "GET /jquery.uploadify-v2.1.0/uploadify.css? HTTP/1.0" 404 1226 "-" "-"
    146.185.18.82 - - [19/Dec/2012:16:33:10 +0000] "GET /theme/default/js/uploadify/uploadify.css? HTTP/1.0" 404 1226 "-" "-"
    146.185.18.82 - - [19/Dec/2012:16:33:10 +0000] "GET /wp-content/plugins/nmedia-user-file-uploader/js/uploadify/uploadify.css? HTTP/1.0" 404 1226 "-" "-"

    146.185.18.82 - - [19/Dec/2012:08:36:43 +0000] "GET /uploadify-2.1.0/uploadify.css? HTTP/1.0" 404 1226 "-" "-"
    146.185.18.82 - - [19/Dec/2012:08:36:43 +0000] "GET /uploadify/uploadify.css? HTTP/1.0" 404 1226 "-" "-"
    146.185.18.82 - - [19/Dec/2012:08:38:25 +0000] "GET /js/jquery.uploadify-v2.1.4/uploadify.css? HTTP/1.0" 404 1226 "-" "-"

    146.185.18.82 - - [19/Dec/2012:00:52:15 +0000] "GET /scripts/uploadify.css? HTTP/1.0" 404 1226 "-" "-"
    146.185.18.82 - - [19/Dec/2012:00:52:15 +0000] "GET /js/uploadify/uploadify.css? HTTP/1.0" 404 1226 "-" "-"
    146.185.18.82 - - [19/Dec/2012:00:52:15 +0000] "GET /uploadify-2.1.4/uploadify.css? HTTP/1.0" 404 1226 "-" "-"

    B.

    200.160.238.161 - - [19/Dec/2012:19:19:25 +0000] "GET / HTTP/1.0" 304 - "-" "Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0"
    200.160.238.161 - - [19/Dec/2012:19:19:26 +0000] "GET /catalog/ HTTP/1.0" 404 1223 "-" "Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0"
    200.160.238.161 - - [19/Dec/2012:19:19:26 +0000] "GET /shop HTTP/1.0" 404 1223 "-" "Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0"
    200.160.238.161 - - [19/Dec/2012:19:19:27 +0000] "GET /oscommerce/ HTTP/1.0" 404 1223 "-" "Mozilla/5.0 (Windows NT 6.1; rv:16.0) Gecko/20100101 Firefox/16.0"


    Any knowledge appreciated.

    KDU
     
  2. BrandiCandi

    BrandiCandi Guest

    What are we looking at? Are these snippets of firewall logs?
     
  3. treehouse786

    treehouse786 Registered Member

    Joined:
    Jun 6, 2010
    Posts:
    1,411
    Location:
    Lancashire
    well a domain name would help.

    www.limesurvey.org - is this your website? if not then are you linking to it or using a script sourced from this website?

    you happen to be using a survey script?

    is the above your web servers traffic logs?

    anyway it seems you have code in your HTML files linking to CSS/script and a few HTML files which are not on your web server, this most likely occurred because you used a template and never utilized all the pages within that template.

    as long as your website is displaying/functioning correctly then you can remove the references to the non-existent files from your HTML code.
     
  4. kdu

    kdu Registered Member

    Joined:
    Dec 21, 2012
    Posts:
    4
    Location:
    Australia

    Hello, sorry about leaving bits out, yes, these are snippets from a log, my servers access_log file.:p
     
  5. kdu

    kdu Registered Member

    Joined:
    Dec 21, 2012
    Posts:
    4
    Location:
    Australia
    Hello, and thanks for your reply, my own domain is www.vk3ukf.com.

    www.limesurvey.org has nothing to do with me, and there is no script linking to it, most of the site is static HTML, apart from a test, elsewhere, on that domain for a php forum. I have never heard of that site and I have no links to it.

    What looks like has happened (to me at the moment), is that google is searching for something that has never been on my server.o_O
     
  6. treehouse786

    treehouse786 Registered Member

    Joined:
    Jun 6, 2010
    Posts:
    1,411
    Location:
    Lancashire
    i will have a look tonight and let you know if/where those missing file references are coming from
     
  7. kdu

    kdu Registered Member

    Joined:
    Dec 21, 2012
    Posts:
    4
    Location:
    Australia
    Hi again,

    I downloaded the entire website to a local HDD and did a search on it using Hdsearchandstats software that will search all ascii/txt files for a string.

    I searched for,
    "84630-include-surveyid-and-qcodes"

    Nothing found in any website files, it did point at my access_log file though, because that is the only mention of it, which is why I am scratching my head.
    o_O
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.