Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a small digital ocean instance running a personal blog. I recently set up apache logging and noticed people are making requests trying to hack wordpress (I'm not running wordpress). I also noticed this request appearing a couple of times, and I'm not sure what would be making it:

127.0.0.1 - - [05/Mar/2014:14:57:30 -0600] "OPTIONS * HTTP/1.0" 200 126

Does anyone have any ideas? If there's a chance someone has put a root kit on this instance I'd just as soon throw it away and start over and secure the next one better.

share|improve this question
    
Are you running cPanel on the machine? If so, see forums.cpanel.net/f5/… – Oliver Salzburg Mar 6 '14 at 19:35
    
No I'm not. Apache + Django + PostgreSQL + GeoServer – canisrufus Mar 6 '14 at 19:38
    
there is absolutely no reason why if it's 127.0.0.1 it's local so no reason why you can't find out what program it is. netstat -aon see the PID. gotta be done when the request happens though – barlop Mar 6 '14 at 19:38
    
@OliverSalzburg okay, that makes me feel significantly better about it. If I was pwned, why would someone keep making that call? Doesn't seem like that makes sense. – canisrufus Mar 6 '14 at 19:42
1  
I'm pretty sure this is a call Apache HTTPD does to monitor itself when mod_status is enabled to generate the /server-status page. Or at least something of that kind. Personally, I wouldn't worry about it – Oliver Salzburg Mar 6 '14 at 19:49

You must log in to answer this question.

Browse other questions tagged .