Hi all,

I hope I have got the right forum for this....

I have a custom Error 404 page which is asp. I capture the referrer and the destination URL plus the remote IP address and insert it in a SQL database. This great for finding internal bad links and bad links from external sites plus missing files on my site.

Lets say MySite.com/default.asp is my homepage. Recently there have been thousands of records where the referrer and destination are  MySite.com/index.php. Having an MS IIS server this seems ridiculous.

I see lots of strange URLs probably testing my security but for the life of me I can't understand the point of this index.php thing. Has anybody seen this as well or has any theories please?  

Index.php would be the default page for your site if your site is PHP based.  My first reaction is that something is simply asking for this file.  Something in this case could be a reconnaissance script, trying to determine if you are running PHP.  Personally, I wouldn't worry too much about looking for this particular file.  If they start trying to hit other things, typically PHPMyAdmin, then it is a sign that they have more malicious intentions.

The real bottom line is that there is little that you can do about these types of attempts, other than not make them available to the public and use utilities that will ban them should they make too many scan attempts.
 

Thanks for the reply, will stop worrying.