Arch Linux

gwoodruff

Member

Registered: 2022-01-11

Posts: 11

wierd ip's in php error log

I recently had a php error and checking the logs found 100's of entries like the following:

84.191.86.206 - - [10/Jan/2022:06:31:25 -0500] "GET /sql/sqladmin/index.php?lang=en HTTP/1.1" 404 986
84.191.86.206 - - [10/Jan/2022:06:31:25 -0500] "GET /pma2014/index.php?lang=en HTTP/1.1" 404 986
84.191.86.206 - - [10/Jan/2022:06:31:25 -0500] "GET /phpMyAdmin5/index.php?lang=en HTTP/1.1" 404 986
84.191.86.206 - - [10/Jan/2022:06:31:26 -0500] "GET /phpmyadmin2016/index.php?lang=en HTTP/1.1" 404 986
84.191.86.206 - - [10/Jan/2022:06:31:26 -0500] "GET /sql/websql/index.php?lang=en HTTP/1.1" 404 986
84.191.86.206 - - [10/Jan/2022:06:31:26 -0500] "GET /php-my-admin/index.php?lang=en HTTP/1.1" 404 986
84.191.86.206 - - [10/Jan/2022:06:31:26 -0500] "GET /phpmy/index.php?lang=en HTTP/1.1" 404 986
84.191.86.206 - - [10/Jan/2022:06:31:27 -0500] "GET /phpMyAdmin-4.9.7-english/index.php?lang=en HTTP/1.1" 404 986
84.191.86.206 - - [10/Jan/2022:06:31:27 -0500] "GET /administrator/pma/index.php?lang=en HTTP/1.1" 404 986
84.191.86.206 - - [10/Jan/2022:06:31:27 -0500] "GET /phpMyAdmin4/index.php?lang=en HTTP/1.1" 404 986

The server is for lan access only. Should I be concerned and / or are there any steps I can do to make it more secure?

tucuxi

Member

From: Switzerland

Registered: 2020-03-08

Posts: 291

Re: wierd ip's in php error log

That is an IP address from the Deutsche Telekom range, probably a bot trying a few simple attacks. What you should do depends on your setup and what you want. You could start by isolating your LAN from the public internet.