Apache Access Log - Security Concerns

Question

My server is in the US - the statistics/logs/access_log.processed for my website show access from RU 94.181.76.169 via a referring webpage http:// artefakct .com/new-products IP 93.171.133.245 (Kazakhstan) a few minutes later a similar set of entries for refer taserpolice2. apishops. ru

(Spaces in urls added to diable links & pass edits for posting)

I assume that the GET / HTTP/1.0" 200 means my homepage was accessed. I looked at the code behind on http:// artefakct. com/new-products and found no reference to my IP or URL. I don not advertise so no PPC which would have been a different referrer. Both sites look legitimate. Is my site being scanned by an infected server / is there reason to be concerned? Can anyone explain this. Thank you.

statistics/logs/access_log.processed segments

94.181.76.169 - - [11/Jan/2015:05:28:40 -0700] "GET / HTTP/1.0" 200 6626 "http:// artefakct.com/new-products" "Opera/9.00 (Windows NT 4.0; U; en)"
94.181.76.169 - - [11/Jan/2015:05:28:40 -0700] "GET / HTTP/1.0" 200 6626 "http:// artefakct.com/new-products" "Mozilla/4.0 (compatible; MSIE 6.0; America Online Browser 1.1; rev1.2; Windows NT 5.1; SV1; .NET CLR 1.1.4322)"
94.181.76.169 - - [11/Jan/2015:05:28:41 -0700] "GET / HTTP/1.0" 200 6626 "http:// artefakct.com/new-products" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Maxthon; .NET CLR 1.1.4322)"
94.181.76.169 - - [11/Jan/2015:05:28:41 -0700] "GET / HTTP/1.0" 200 6626 "http:// artefakct.com/new-products" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)"

94.181.76.169 - - [11/Jan/2015:09:20:53 -0700] "GET / HTTP/1.0" 200 6626 "http:// taserpolice2. apishops. ru" "Mozilla/5.0 (Windows NT 5.1; U; en) Opera 8.01"
94.181.76.169 - - [11/Jan/2015:09:20:54 -0700] "GET / HTTP/1.0" 200 6626 "http:// taserpolice2. apishops. ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT) ::ELNSB50::000061100320025802a00111000000000507000900000000"
94.181.76.169 - - [11/Jan/2015:09:20:54 -0700] "GET / HTTP/1.0" 200 6626 "http:// taserpolice2. apishops. ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; T312461)"
94.181.76.169 - - [11/Jan/2015:09:20:55 -0700] "GET / HTTP/1.0" 200 6626 "http:// taserpolice2. apishops. ru" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; MRA 4.6 (build 01425); MRSPUTNIK 1, 5, 0, 19 SW)"

Eilidh Fridlington · Accepted Answer · 2015-01-13T19:54:50.153

They are simply spam referrers, nothing at all to be worried about.

The idea behind it is that some content management systems display a page listing the top referrers to the site and thus, the spam referrers can get links back from your site to theirs by creating the requests that you see in your logs.

It's all to do with search engine ranking - back in the days when the internet was powered by steam you could increase your position in search engine results by having a large number of incoming links to your site. This hasn't worked for years but unfortunately they haven't got the message.

You can safely ignore them as they pose no threat further than to annoy you.

Apache Access Log - Security Concerns

1 Answers1