500 errors in access log, other strangeness

  • This is from my wordpress log from last week. I’m on the latest version. (No, I don’t have access to the error logs.)

    /var/log/apache2-vhosts/alang/access.log.8.gz:76.119.240.176 – – [14/Mar/2011:11:49:17 -0700] “POST https://dogsofsf.com/wp-comments-post.php HTTP/1.1” 500 834 “https://dogsofsf.com/?p=1595” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)” 715 1250
    /var/log/apache2-vhosts/alang/access.log.8.gz:76.119.240.176 – – [14/Mar/2011:12:02:17 -0700] “POST https://dogsofsf.com/wp-comments-post.php HTTP/1.1” 500 834 “https://dogsofsf.com/?p=732” “Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en) AppleWebKit/51 (like Gecko) Safari/51” 736 1250
    /var/log/apache2-vhosts/alang/access.log.8.gz:76.119.240.176 – – [14/Mar/2011:12:25:06 -0700] “POST https://dogsofsf.com/wp-comments-post.php HTTP/1.1” 500 834 “https://dogsofsf.com/?p=732” “Mozilla/5.0 (Macintosh; U; PPC Mac OS X; en-US; rv:1.0.2) Gecko/20020924 AOL/7.0” 732 1250
    /var/log/apache2-vhosts/alang/access.log.8.gz:76.119.240.176 – – [14/Mar/2011:12:26:41 -0700] “POST https://dogsofsf.com/wp-comments-post.php HTTP/1.1” 500 834 “https://dogsofsf.com/?p=1595” “Mozilla/4.0 (compatible; MSIE 4.01; AOL 4.0; Mac_68K)” 720 1250
    /var/log/apache2-vhosts/alang/access.log.8.gz:76.119.240.176 – – [14/Mar/2011:12:30:36 -0700] “POST https://dogsofsf.com/wp-comments-post.php HTTP/1.1” 500 834 “https://dogsofsf.com/?p=1595” “Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1) Gecko/20061010 Firefox/2.0” 749 1250
    /var/log/apache2-vhosts/alang/access.log.8.gz:76.119.240.176 – – [14/Mar/2011:12:36:55 -0700] “POST https://dogsofsf.com/wp-comments-post.php HTTP/1.1” 500 834 “https://dogsofsf.com/?p=732” “Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1)” 691 1250
    /var/log/apache2-vhosts/alang/access.log.8.gz:76.119.240.176 – – [14/Mar/2011:12:39:01 -0700] “POST https://dogsofsf.com/wp-comments-post.php HTTP/1.1” 500 834 “https://dogsofsf.com/?p=732” “Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.4) Gecko/20060508” 738 1250

    Someone is repeatedly trying to comment, from the same IP address, on two different articles, over the course of 50 minutes, and each POST uses a different user-agent string. (Well, I say someone, but there’re at least five or six IPs displaying similar actions.)

    I can’t imagine how that could be a legitimate attempt to post something… why would the browser id change every time?

    It could be a spammer. Does the anti-spam plugin give 500 errors when someone tries to post spam? Or something like that? That sounds totally insane, but…

    It could be someone trying to hack my server, I guess. Is there a former or current security hole in WordPress that can be exploited by posting corrupted comments or anything like that?

    I’m worried that I’m getting 500 errors here, though.

    The blog is https://dogsofsf.com/ (if it matters.)

Viewing 1 replies (of 1 total)
  • Thread Starter adamlang

    (@adamlang)

    Further info: this appears to happen sometimes when people comment. It has happened during about five distinct periods, and didn’t happen in between. It *may* only happen to spammy comments (no non-spammy comments were found in those time periods, with or without 500 errors — my blog doesn’t get a lot of comments.) So this could be WordPress, or it could be Akismet.

    I tried posting a regular comment, and it worked fine. I tried a spammy comment with a new username/email combo, and it went to the spam queue, and didn’t end up with a 500 error. So it’s not happening right now.

Viewing 1 replies (of 1 total)
  • The topic ‘500 errors in access log, other strangeness’ is closed to new replies.