2

I am receiving the following error log on my apache2 server:

[Mon Dec 24 09:38:48.580631 2018] [php7:error] [pid 19547] [client 5.188.210.12:11267] script '/var/www/echo.php' not found or unable to stat, referer: https://www.google.com/ [Mon Dec 24 18:16:33.851584 2018] [php7:error] [pid 19523] [client 91.211.247.248:45013] script '/var/www/xmlrpc.php' not found or unable to stat [Tue Dec 25 03:28:48.912986 2018] [php7:error] [pid 19551] [client 185.244.25.106:47712] script '/var/www/index.php' not found or unable to stat [Tue Dec 25 04:15:30.013401 2018] [php7:error] [pid 19527] [client 118.25.71.119:37946] script '/var/www/help.php' not found or unable to stat I am sure that's just bruteforcing on existing scripts. But how can this throw a PHP7 error? What do the ports mean as I am not using any of those?

dmuensterer
  • 143
  • 1
  • 6

1 Answers1

3

Apache passed the request to PHP because the URL ended in .php and Apache was configured to do so with an AddHandler directive.

The port number and IP address are of the remote system.

These are being logged because the PHP script corresponding to the URL does not exist or cannot be accessed. A 404 error is returned.

And yes, it looks like automated brute forcing attempts. You can ignore these or enable the relevant fail2ban jail.

Michael Hampton
  • 244,070
  • 43
  • 506
  • 972