0

My family's business runs a website with GoDaddy for promotional purposes. I checked the logs the other day and found some really strange traffic that I don't exactly understand:

188.234.248.201 - - [31/Jan/2019:10:22:26 -0700] "GET / HTTP/1.1" 301 241 "http://reduslimofficial.ru/about/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134"
185.127.17.253 - - [31/Jan/2019:10:23:15 -0700] "GET / HTTP/1.1" 301 237 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11"
216.244.66.244 - - [31/Jan/2019:11:06:44 -0700] "GET /robots.txt HTTP/1.1" 301 251 "-" "Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/dotbot, help@moz.com)"
178.137.89.36 - - [31/Jan/2019:11:37:03 -0700] "GET /index.php/about/ HTTP/1.1" 301 257 "https://videotop.biz/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1"
178.137.89.36 - - [31/Jan/2019:11:37:03 -0700] "GET /index.php/about/ HTTP/1.1" 301 257 "https://videotop.biz/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1"
178.137.89.36 - - [31/Jan/2019:11:37:04 -0700] "GET /index.php/about/ HTTP/1.1" 301 257 "https://videotop.biz/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1"
178.137.89.36 - - [31/Jan/2019:11:37:04 -0700] "GET /index.php/about/ HTTP/1.1" 301 257 "https://videotop.biz/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1"
178.137.89.36 - - [31/Jan/2019:11:37:05 -0700] "GET /index.php/about/ HTTP/1.1" 301 257 "https://videotop.biz/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1"
178.137.89.36 - - [31/Jan/2019:11:37:05 -0700] "GET /index.php/about/ HTTP/1.1" 301 257 "https://videotop.biz/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1"
34.73.100.219 - - [31/Jan/2019:11:40:15 -0700] "GET /robots.txt HTTP/1.0" 301 247 "-" "ZoominfoBot (zoominfobot at zoominfo dot com)"
34.73.100.219 - - [31/Jan/2019:11:40:15 -0700] "GET / HTTP/1.0" 301 237 "-" "ZoominfoBot (zoominfobot at zoominfo dot com)"
180.76.15.9 - - [31/Jan/2019:11:45:18 -0700] "GET / HTTP/1.1" 301 237 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
216.244.66.244 - - [31/Jan/2019:11:53:47 -0700] "GET /robots.txt HTTP/1.1" 301 247 "-" "Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/dotbot, help@moz.com)"
60.191.38.77 - - [31/Jan/2019:11:55:31 -0700] "GET / HTTP/1.1" 301 237 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
159.138.5.222 - - [31/Jan/2019:12:01:57 -0700] "GET /administrator/ HTTP/1.0" 301 251 "http://www.alancoxonachip.com/wp-login.php" "Opera/9.80 (Windows NT 6.1) Presto/2.12.388 Version/12.12"

Some of this I understand, for instance, the ZoominfoBot seems like it's most likely just a crawler. Baidu I understand to be the Chinese Google, and I've seen Yandex, the Russian Google, index my site as well. But what are all these websites like "videotop.biz/" and "reduslimofficial.ru/about/". There is a significant amount of traffic that seems to say "301" instaed of "200" and this causes me some concern.

One thought is that I don't understand the nature of the logs. That perhaps that's a referrer domain. The other possibility is that there's some malware on the server being used for a proxy.

Note: I am unsure what web server they use. I am pretty sure the OS is RHEL. But sshing into the server sandboxes me and ps aux provides very limited information. I strongly suspect, given the nature of the company, that it is apache (the 404 page does not say nginx, though I am unsure if that proves anything).

So, my question is: why are there so many weird websites showing up in my family's (entirely local to Florida) business's website's server logs? What do the logs mean?

| improve this question | |
  • 2
    I blocked pretty much all of the most know engines with mod_security., at least until I found out blocking Google impacted negatively my SEO ranking. As for remote addresses visiting you there is not that much to understand, business as usual. Rest assured the KGB is not after your site. – Rui F Ribeiro Mar 2 '19 at 13:41
  • @RuiFRibeiro sorry for the clickbait title, lol. There's plenty of non-Russian traffic. It's just the .ru's stand out to me. – malan88 Mar 2 '19 at 13:43
  • 1
    Alan Cox is on a chip, now?!? – Jeff Schaller♦ Mar 2 '19 at 13:45
  • 1
    I could write an answer offering some advice for Linux systems, as I handled servers with hundreds of vhosts in the past, but since we are talking about a Godaddy hosting service in which you do not even know the HTTP daemon, is even this on topic here? – Rui F Ribeiro Mar 2 '19 at 13:54
  • 1
    @Rob If you understand the format of the log files to explain why there are websites foreign to my server's domain names, please answer the question. I'm pretty sure that the format of log files in web servers specific to *nix are, in fact, valid U&L questions. I see thousands of questions about apache and nginx. – malan88 Mar 2 '19 at 15:09
1

That perhaps that's a referrer domain.

I think you've guessed correctly, assuming you're using the fairly common combined Apache log file format, in which case that field is the \"%{Referer}i\", which is fully under the control of the requesting client. Either it's the link that an actual human clicked into your site from or it's populated by the code in a crawler 'bot of some type.

Webmasters find the data useful to determine usage patterns of their sites and to know who might be linking to their site. If the data isn't helpful for your business, my advice would be to ignore it.

| improve this answer | |
  • Thanks Jeff. That's exactly what I was asking. – malan88 Mar 2 '19 at 17:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.