2

I have a wordpress site and periodically I see things like this in the access logs:

256.73.103.356 - - [10/Jun/2018:10:55:51 +0000] "HEAD /search/www.rijfk.cn HTTP/1.1" 200 0 "-" "-"
256.73.103.356 - - [10/Jun/2018:13:04:28 +0000] "HEAD /search/www.asdf.com HTTP/1.1" 200 0 "-" "-"
256.73.103.356 - - [10/Jun/2018:13:24:30 +0000] "HEAD /search/www.ionfkd.com HTTP/1.1" 200 0 "-" "-"
256.73.103.356 - - [10/Jun/2018:13:33:28 +0000] "HEAD /search/www.rijfk.cn HTTP/1.1" 200 0 "-" "-"

I've changed some of the details (IP address, and domain names - those didn't seem like specific crucial to diagnosis).

I'm not sure is going on why someone is doing this. What are they trying to do? Is this benign or something to fight?

  • This can mean a few things , i. bots try to check whether you are using default search path to see there is vulnerabilities to exploit and/or ii. your wordpress has been compromised, the bot try to upload/download something, or redirect request(thru rewrite) to the stated URL. – mootmoot Jul 23 '18 at 14:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.