Question

Is my server being targeted?

In my apache2 error logs I am seeing odd bursts of PHP errors. I do not have PHP setup on my server, so what is going on?

This is a small snippet:

[Tue Oct 09 08:08:04.502952 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/zuoss.php’ not found or unable to stat [Tue Oct 09 08:08:04.750811 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/zuoshss.php’ not found or unable to stat [Tue Oct 09 08:08:04.998853 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/boots.php’ not found or unable to stat [Tue Oct 09 08:08:05.247006 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/she.php’ not found or unable to stat [Tue Oct 09 08:08:05.494998 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/s.php’ not found or unable to stat [Tue Oct 09 08:08:05.742912 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/qw.php’ not found or unable to stat [Tue Oct 09 08:08:05.990853 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/test.php’ not found or unable to stat [Tue Oct 09 08:08:06.238847 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/caonma.php’ not found or unable to stat [Tue Oct 09 08:08:06.486982 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/ss.php’ not found or unable to stat [Tue Oct 09 08:08:06.734769 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/wcp.php’ not found or unable to stat [Tue Oct 09 08:08:06.982960 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/u.php’ not found or unable to stat [Tue Oct 09 08:08:07.230921 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/uuu.php’ not found or unable to stat [Tue Oct 09 08:08:07.478976 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/sss.php’ not found or unable to stat [Tue Oct 09 08:08:07.726947 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/1.php’ not found or unable to stat [Tue Oct 09 08:08:07.974998 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/2.php’ not found or unable to stat [Tue Oct 09 08:08:08.222836 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/core.php’ not found or unable to stat [Tue Oct 09 08:08:08.470916 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/qaz.php’ not found or unable to stat [Tue Oct 09 08:08:08.718896 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/sha.php’ not found or unable to stat [Tue Oct 09 08:08:08.968264 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/ppx.php’ not found or unable to stat [Tue Oct 09 08:08:09.215256 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/1.php’ not found or unable to stat [Tue Oct 09 08:08:09.463184 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/confg.php’ not found or unable to stat [Tue Oct 09 08:08:09.711037 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/conf1g.php’ not found or unable to stat [Tue Oct 09 08:08:09.959197 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/ver.php’ not found or unable to stat [Tue Oct 09 08:08:10.207198 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/hack.php’ not found or unable to stat [Tue Oct 09 08:08:10.455961 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/qa.php’ not found or unable to stat [Tue Oct 09 08:08:10.704654 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/Ss.php’ not found or unable to stat [Tue Oct 09 08:08:10.953094 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/xxx.php’ not found or unable to stat [Tue Oct 09 08:08:11.201084 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/92.php’ not found or unable to stat [Tue Oct 09 08:08:11.449283 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/z.php’ not found or unable to stat [Tue Oct 09 08:08:11.697121 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/x.php’ not found or unable to stat [Tue Oct 09 08:08:11.945030 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/nuoxi.php’ not found or unable to stat [Tue Oct 09 08:08:12.193043 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/godkey.php’ not found or unable to stat [Tue Oct 09 08:08:12.441391 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/okokok.php’ not found or unable to stat [Tue Oct 09 08:08:12.690300 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/erwa.php’ not found or unable to stat [Tue Oct 09 08:08:12.939132 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/pma.php’ not found or unable to stat [Tue Oct 09 08:08:13.187299 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/ruyi.php’ not found or unable to stat [Tue Oct 09 08:08:13.438435 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/51314.php’ not found or unable to stat [Tue Oct 09 08:08:13.687159 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/5201314.php’ not found or unable to stat [Tue Oct 09 08:08:13.935482 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/fusheng.php’ not found or unable to stat [Tue Oct 09 08:08:14.183113 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/general.php’ not found or unable to stat [Tue Oct 09 08:08:14.431078 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/repeat.php’ not found or unable to stat [Tue Oct 09 08:08:14.679295 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/ldw.php’ not found or unable to stat [Tue Oct 09 08:08:14.927229 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/api.php’ not found or unable to stat [Tue Oct 09 08:08:15.176429 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/s1.php’ not found or unable to stat [Tue Oct 09 08:08:15.425896 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/xiaodai.php’ not found or unable to stat [Tue Oct 09 08:08:15.676222 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/hello.php’ not found or unable to stat

Subscribe
Share

Consider using a Web Application Firewall (WAF) to protect your server against these types attacks.


Submit an answer
You can type!ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Accepted Answer

Someone’s running a script vulnerability scanner against your server. It’s likely a bot and not targeted. You can safely ignore these errors.

try using fail2ban

apt-get install fail2ban

then copy jail.conf to jail.local

cd /etc/fail2ban
cp jail.conf jail.local

edit jail.local search apache-noscript

then add this line

[apache-noscript]
enabled=true

finally

service fail2ban restart

check with

fail2ban-client status apache-noscript