Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have a small digital ocean instance running a personal blog. I recently set up apache logging and noticed people are making requests trying to hack wordpress (I'm not running wordpress). I also noticed this request appearing a couple of times, and I'm not sure what would be making it:

127.0.0.1 - - [05/Mar/2014:14:57:30 -0600] "OPTIONS * HTTP/1.0" 200 126

Does anyone have any ideas? If there's a chance someone has put a root kit on this instance I'd just as soon throw it away and start over and secure the next one better.

share|improve this question
    
Are you running cPanel on the machine? If so, see forums.cpanel.net/f5/… –  Oliver Salzburg Mar 6 at 19:35
    
No I'm not. Apache + Django + PostgreSQL + GeoServer –  canisrufus Mar 6 at 19:38
    
there is absolutely no reason why if it's 127.0.0.1 it's local so no reason why you can't find out what program it is. netstat -aon see the PID. gotta be done when the request happens though –  barlop Mar 6 at 19:38
    
@OliverSalzburg okay, that makes me feel significantly better about it. If I was pwned, why would someone keep making that call? Doesn't seem like that makes sense. –  canisrufus Mar 6 at 19:42
1  
I'm pretty sure this is a call Apache HTTPD does to monitor itself when mod_status is enabled to generate the /server-status page. Or at least something of that kind. Personally, I wouldn't worry about it –  Oliver Salzburg Mar 6 at 19:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.