Is my server being targeted?

October 10, 2018 2.3k views
PHP Logging Ubuntu 18.04

In my apache2 error logs I am seeing odd bursts of PHP errors. I do not have PHP setup on my server, so what is going on?

This is a small snippet:

[Tue Oct 09 08:08:04.502952 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/zuoss.php' not found or unable to stat
[Tue Oct 09 08:08:04.750811 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/zuoshss.php' not found or unable to stat
[Tue Oct 09 08:08:04.998853 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/boots.php' not found or unable to stat
[Tue Oct 09 08:08:05.247006 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/she.php' not found or unable to stat
[Tue Oct 09 08:08:05.494998 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/s.php' not found or unable to stat
[Tue Oct 09 08:08:05.742912 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/qw.php' not found or unable to stat
[Tue Oct 09 08:08:05.990853 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/test.php' not found or unable to stat
[Tue Oct 09 08:08:06.238847 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/caonma.php' not found or unable to stat
[Tue Oct 09 08:08:06.486982 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/ss.php' not found or unable to stat
[Tue Oct 09 08:08:06.734769 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/wcp.php' not found or unable to stat
[Tue Oct 09 08:08:06.982960 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/u.php' not found or unable to stat
[Tue Oct 09 08:08:07.230921 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/uuu.php' not found or unable to stat
[Tue Oct 09 08:08:07.478976 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/sss.php' not found or unable to stat
[Tue Oct 09 08:08:07.726947 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/1.php' not found or unable to stat
[Tue Oct 09 08:08:07.974998 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/2.php' not found or unable to stat
[Tue Oct 09 08:08:08.222836 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/core.php' not found or unable to stat
[Tue Oct 09 08:08:08.470916 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/qaz.php' not found or unable to stat
[Tue Oct 09 08:08:08.718896 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/sha.php' not found or unable to stat
[Tue Oct 09 08:08:08.968264 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/ppx.php' not found or unable to stat
[Tue Oct 09 08:08:09.215256 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/1.php' not found or unable to stat
[Tue Oct 09 08:08:09.463184 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/confg.php' not found or unable to stat
[Tue Oct 09 08:08:09.711037 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/conf1g.php' not found or unable to stat
[Tue Oct 09 08:08:09.959197 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/ver.php' not found or unable to stat
[Tue Oct 09 08:08:10.207198 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/hack.php' not found or unable to stat
[Tue Oct 09 08:08:10.455961 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/qa.php' not found or unable to stat
[Tue Oct 09 08:08:10.704654 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/Ss.php' not found or unable to stat
[Tue Oct 09 08:08:10.953094 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/xxx.php' not found or unable to stat
[Tue Oct 09 08:08:11.201084 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/92.php' not found or unable to stat
[Tue Oct 09 08:08:11.449283 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/z.php' not found or unable to stat
[Tue Oct 09 08:08:11.697121 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/x.php' not found or unable to stat
[Tue Oct 09 08:08:11.945030 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/nuoxi.php' not found or unable to stat
[Tue Oct 09 08:08:12.193043 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/godkey.php' not found or unable to stat
[Tue Oct 09 08:08:12.441391 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/okokok.php' not found or unable to stat
[Tue Oct 09 08:08:12.690300 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/erwa.php' not found or unable to stat
[Tue Oct 09 08:08:12.939132 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/pma.php' not found or unable to stat
[Tue Oct 09 08:08:13.187299 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/ruyi.php' not found or unable to stat
[Tue Oct 09 08:08:13.438435 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/51314.php' not found or unable to stat
[Tue Oct 09 08:08:13.687159 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/5201314.php' not found or unable to stat
[Tue Oct 09 08:08:13.935482 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/fusheng.php' not found or unable to stat
[Tue Oct 09 08:08:14.183113 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/general.php' not found or unable to stat
[Tue Oct 09 08:08:14.431078 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/repeat.php' not found or unable to stat
[Tue Oct 09 08:08:14.679295 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/ldw.php' not found or unable to stat
[Tue Oct 09 08:08:14.927229 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/api.php' not found or unable to stat
[Tue Oct 09 08:08:15.176429 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/s1.php' not found or unable to stat
[Tue Oct 09 08:08:15.425896 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/xiaodai.php' not found or unable to stat
[Tue Oct 09 08:08:15.676222 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script '/var/www/html/hello.php' not found or unable to stat

1 comment
1 Answer
unixynet October 10, 2018
Accepted Answer

Someone's running a script vulnerability scanner against your server. It's likely a bot and not targeted. You can safely ignore these errors.

Have another answer? Share your knowledge.