Question

Is my server being targeted?

In my apache2 error logs I am seeing odd bursts of PHP errors. I do not have PHP setup on my server, so what is going on?

This is a small snippet:

[Tue Oct 09 08:08:04.502952 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/zuoss.php’ not found or unable to stat [Tue Oct 09 08:08:04.750811 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/zuoshss.php’ not found or unable to stat [Tue Oct 09 08:08:04.998853 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/boots.php’ not found or unable to stat [Tue Oct 09 08:08:05.247006 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/she.php’ not found or unable to stat [Tue Oct 09 08:08:05.494998 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/s.php’ not found or unable to stat [Tue Oct 09 08:08:05.742912 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/qw.php’ not found or unable to stat [Tue Oct 09 08:08:05.990853 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/test.php’ not found or unable to stat [Tue Oct 09 08:08:06.238847 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/caonma.php’ not found or unable to stat [Tue Oct 09 08:08:06.486982 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/ss.php’ not found or unable to stat [Tue Oct 09 08:08:06.734769 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/wcp.php’ not found or unable to stat [Tue Oct 09 08:08:06.982960 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/u.php’ not found or unable to stat [Tue Oct 09 08:08:07.230921 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/uuu.php’ not found or unable to stat [Tue Oct 09 08:08:07.478976 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/sss.php’ not found or unable to stat [Tue Oct 09 08:08:07.726947 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/1.php’ not found or unable to stat [Tue Oct 09 08:08:07.974998 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/2.php’ not found or unable to stat [Tue Oct 09 08:08:08.222836 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/core.php’ not found or unable to stat [Tue Oct 09 08:08:08.470916 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/qaz.php’ not found or unable to stat [Tue Oct 09 08:08:08.718896 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/sha.php’ not found or unable to stat [Tue Oct 09 08:08:08.968264 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/ppx.php’ not found or unable to stat [Tue Oct 09 08:08:09.215256 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/1.php’ not found or unable to stat [Tue Oct 09 08:08:09.463184 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/confg.php’ not found or unable to stat [Tue Oct 09 08:08:09.711037 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/conf1g.php’ not found or unable to stat [Tue Oct 09 08:08:09.959197 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/ver.php’ not found or unable to stat [Tue Oct 09 08:08:10.207198 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/hack.php’ not found or unable to stat [Tue Oct 09 08:08:10.455961 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/qa.php’ not found or unable to stat [Tue Oct 09 08:08:10.704654 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/Ss.php’ not found or unable to stat [Tue Oct 09 08:08:10.953094 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/xxx.php’ not found or unable to stat [Tue Oct 09 08:08:11.201084 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/92.php’ not found or unable to stat [Tue Oct 09 08:08:11.449283 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/z.php’ not found or unable to stat [Tue Oct 09 08:08:11.697121 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/x.php’ not found or unable to stat [Tue Oct 09 08:08:11.945030 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/nuoxi.php’ not found or unable to stat [Tue Oct 09 08:08:12.193043 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/godkey.php’ not found or unable to stat [Tue Oct 09 08:08:12.441391 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/okokok.php’ not found or unable to stat [Tue Oct 09 08:08:12.690300 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/erwa.php’ not found or unable to stat [Tue Oct 09 08:08:12.939132 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/pma.php’ not found or unable to stat [Tue Oct 09 08:08:13.187299 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/ruyi.php’ not found or unable to stat [Tue Oct 09 08:08:13.438435 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/51314.php’ not found or unable to stat [Tue Oct 09 08:08:13.687159 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/5201314.php’ not found or unable to stat [Tue Oct 09 08:08:13.935482 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/fusheng.php’ not found or unable to stat [Tue Oct 09 08:08:14.183113 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/general.php’ not found or unable to stat [Tue Oct 09 08:08:14.431078 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/repeat.php’ not found or unable to stat [Tue Oct 09 08:08:14.679295 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/ldw.php’ not found or unable to stat [Tue Oct 09 08:08:14.927229 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/api.php’ not found or unable to stat [Tue Oct 09 08:08:15.176429 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/s1.php’ not found or unable to stat [Tue Oct 09 08:08:15.425896 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/xiaodai.php’ not found or unable to stat [Tue Oct 09 08:08:15.676222 2018] [php7:error] [pid 6280] [client 39.104.146.96:53536] script ‘/var/www/html/hello.php’ not found or unable to stat

Show comments

Submit an answer

This textbox defaults to using Markdown to format your answer.

You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!

Sign In or Sign Up to Answer

These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.

Accepted Answer

Someone’s running a script vulnerability scanner against your server. It’s likely a bot and not targeted. You can safely ignore these errors.

Want to learn more? Join the DigitalOcean Community!

Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in Q&A, subscribe to topics of interest, and get courses and tools that will help you grow as a developer and scale your project or business.

try using fail2ban

apt-get install fail2ban

then copy jail.conf to jail.local

cd /etc/fail2ban
cp jail.conf jail.local

edit jail.local search apache-noscript

then add this line

[apache-noscript]
enabled=true

finally

service fail2ban restart

check with

fail2ban-client status apache-noscript