1

for the past week or so I've noticed I've been getting a lot of strange 404 errors in logs on a Codeigniter based site. A few examples:

404 Page Not Found: Apple-touch-iconpng/index
404 Page Not Found: 404javascriptjs/index
404 Page Not Found: 404testpage4525d2fdc/index
404 Page Not Found: Faviconico/index

Some of them are things that exists (apple-touch-icon.png), but the 404 error has missing file extensions, and a "/index" after it. Some of them are files that don't even exist (404testpage4525d2fdc). I've run through the entire site looking for broken links, and there are none. I'm also not getting any 404 errors showing on the actual site - just in the logs.

My .htaccess file:

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule ^(.*)$ index.php?/$1 [L]

And my routes file:

$route['default_controller'] = 'welcome';
$route['404_override'] = '';
$route['translate_uri_dashes'] = FALSE;
$route[LOGIN_PAGE] = 'users/login';
$route['landlords'] = 'listings/directory/1';
$route['complexes'] = 'listings/directory/2';
$route['managers'] = 'listings/directory/3';
$route['apartments/sublets'] = 'listings/index/13';
$route['apartments/roommates/19'] = 'listings/index/19';
$route['apartments/roommates/20'] = 'listings/index/20';
$route['apartments/roommates/21'] = 'listings/index/21';
$route['apartments/roommates/22'] = 'listings/index/22';
$route['apartments/roommates'] = 'listings/index/14';
$route['apartments/listings'] = 'listings/index/15';
$route['apartment-alerts'] = 'notification/add_notification';
$route['apartments/listings/([0-9]-(beds))'] = 'listings/index/$1';

Like I said, the site itself seems to be working fine, but I can't figure out what's causing these errors to show up in the logs. I've tried searching for answers, but they all seem to be dealing with 404 errors that are showing up on the site, and are actual resources that should be on the server. Any help would be greatly appreciated!

falc2
  • 85
  • 1
  • 6
  • 1
    probably just spam bots scraping your site trying potential urls. – delboy1978uk May 25 '18 at 11:56
  • Despite the requested resources look very strange (as @delboy1978uk stated): possible, that certain browser expect a favicon in HTML headers. Like apple's Safari etc. ? More info here: https://stackoverflow.com/a/12683605/3095216 – BenRoob May 25 '18 at 12:16
  • If you can get your hands of the server access logs - if such a log is set up on your server - you might be able to see where these strange requests are coming from. – DFriend May 25 '18 at 15:50
  • this is the exact reason why i removed this feature in ci ... i like my error logs to be full of actual errors (should they occur). any 404 is not happening because of me but because of some user/bot going to a url that never existed. – Alex May 25 '18 at 22:09
  • So it's sounding like it's bots - is there any way to stop logging those 404s or blocking them? – falc2 May 26 '18 at 10:51

1 Answers1

0

As near as I've been able to figure out in last 20 minutes of research, 404testpage4525d2fdc and 404javascript.js appear to be requested by scanners checking for malicious behavior, particularly on sites using WordPress. (I would guess your rewrite rule is stripping periods from and appending /index to any requested file which doesn't exist.)

One such scanner is Securi. Check your website via https://sitecheck.sucuri.net/results/www.example.com then immediately check your access logs and you'll likely see a new entry for one or both of these locations.

Other web crawlers, likely search engines, are trying to retrieve Apple-touch-icon.png and Favicon.ico to get a logo from your website.

Aufgeschissener Kunde
  • 727
  • 5
  • 10