My family's business runs a website with GoDaddy for promotional purposes. I checked the logs the other day and found some really strange traffic that I don't exactly understand:
188.234.248.201 - - [31/Jan/2019:10:22:26 -0700] "GET / HTTP/1.1" 301 241 "http://reduslimofficial.ru/about/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134"
185.127.17.253 - - [31/Jan/2019:10:23:15 -0700] "GET / HTTP/1.1" 301 237 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11"
216.244.66.244 - - [31/Jan/2019:11:06:44 -0700] "GET /robots.txt HTTP/1.1" 301 251 "-" "Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/dotbot, help@moz.com)"
178.137.89.36 - - [31/Jan/2019:11:37:03 -0700] "GET /index.php/about/ HTTP/1.1" 301 257 "https://videotop.biz/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1"
178.137.89.36 - - [31/Jan/2019:11:37:03 -0700] "GET /index.php/about/ HTTP/1.1" 301 257 "https://videotop.biz/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1"
178.137.89.36 - - [31/Jan/2019:11:37:04 -0700] "GET /index.php/about/ HTTP/1.1" 301 257 "https://videotop.biz/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1"
178.137.89.36 - - [31/Jan/2019:11:37:04 -0700] "GET /index.php/about/ HTTP/1.1" 301 257 "https://videotop.biz/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1"
178.137.89.36 - - [31/Jan/2019:11:37:05 -0700] "GET /index.php/about/ HTTP/1.1" 301 257 "https://videotop.biz/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1"
178.137.89.36 - - [31/Jan/2019:11:37:05 -0700] "GET /index.php/about/ HTTP/1.1" 301 257 "https://videotop.biz/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; InfoPath.1"
34.73.100.219 - - [31/Jan/2019:11:40:15 -0700] "GET /robots.txt HTTP/1.0" 301 247 "-" "ZoominfoBot (zoominfobot at zoominfo dot com)"
34.73.100.219 - - [31/Jan/2019:11:40:15 -0700] "GET / HTTP/1.0" 301 237 "-" "ZoominfoBot (zoominfobot at zoominfo dot com)"
180.76.15.9 - - [31/Jan/2019:11:45:18 -0700] "GET / HTTP/1.1" 301 237 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
216.244.66.244 - - [31/Jan/2019:11:53:47 -0700] "GET /robots.txt HTTP/1.1" 301 247 "-" "Mozilla/5.0 (compatible; DotBot/1.1; http://www.opensiteexplorer.org/dotbot, help@moz.com)"
60.191.38.77 - - [31/Jan/2019:11:55:31 -0700] "GET / HTTP/1.1" 301 237 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:47.0) Gecko/20100101 Firefox/47.0"
159.138.5.222 - - [31/Jan/2019:12:01:57 -0700] "GET /administrator/ HTTP/1.0" 301 251 "http://www.alancoxonachip.com/wp-login.php" "Opera/9.80 (Windows NT 6.1) Presto/2.12.388 Version/12.12"
Some of this I understand, for instance, the ZoominfoBot seems like it's most likely just a crawler. Baidu I understand to be the Chinese Google, and I've seen Yandex, the Russian Google, index my site as well. But what are all these websites like "videotop.biz/" and "reduslimofficial.ru/about/". There is a significant amount of traffic that seems to say "301" instaed of "200" and this causes me some concern.
One thought is that I don't understand the nature of the logs. That perhaps that's a referrer domain. The other possibility is that there's some malware on the server being used for a proxy.
Note: I am unsure what web server they use. I am pretty sure the OS is RHEL. But sshing into the server sandboxes me and ps aux
provides very limited information. I strongly suspect, given the nature of the company, that it is apache (the 404 page does not say nginx
, though I am unsure if that proves anything).
.ru
's stand out to me. – malan Mar 2 at 13:43