Dear All,
I notice there is two lines /KoolTabs/kooltabs.php?32981a13284db7a9021131df49e6cd203 and /KoolTabs/styles/silver/silver.css in my log 403 Not Found error. We are wondering as risk via this tool or any known penetration so that we can stop using it too.

If its not installed then you don't need to think about it.

Dear Unspawn,
It is installed just happened that is not the right folder it managed to traverse too.

Then check the vendor for version / vulnerability reports, update if necessary and move the files to the right directory?..

Dear Unspawn,
For example I am using is say folder /abc/v1/kooltabs but the error was found to be /kooltabs. So it means they have attempted to scan for it right?

Like other tools Logwatch only analyses events leaving the final vuln / not vuln verdict to the person doing the analysis. So if the resource was searched for in the cause of a regular browsing session (grep access / error logs for IP address) then the developer could have made an error but if other resources include only often scanned for ones like web-based management panels or other commonly known vulnerabilities then it was likely scanned for.

Dear Unspawn,
I have google on the kooltabs so far did not find any vuln linking to it either. I dont really get you here "So if the resource was searched for in the cause of a regular browsing session (grep access / error logs for IP address) then the developer could have made an error but if other resources include only often scanned for ones like web-based management panels or other commonly known vulnerabilities then it was likely scanned for." What do you mean here" You mean to first look for access and error logs is it? Ok based on the IP you want to determine is it valid access is it ? I dont get you here "developer could have made an error" ? What error you mean on programming or interpreting the results?

Yes. Just grep your access and error logs for that particular IP address, about 10 to 20 lines leading up to the KoolTabs one should do, and post the output here.

Dear Unspawn,
Something puzzle me here now I took all my log file for few months n when through manually. I notice this quite a number of times and what puzzle me is that most of the Directory index forbidden by Options directive have some referer but this one dont have. I am worried that they know my directory structure and trying to attack. Could it be any scanners?

Error log has differently formatted lines, not the same as access log.

Dear Unspawn,
Below are some of it from the access log.

Apart from accessing "/" these are all 30x to 40x type return codes. No harm done, the IP seems to be a scraper, but if you don't like it feel free to use something like fail2ban + ipset to block access.

Dear Unspawn,
Great but I want to learn this too. How do you know its scraper ? So which type of codes are harm full ? I have ban the ip from my firewall itself. But what surprises me is that the have traverse through my directory that worries me. They know my main directory and sub directories too. Any idea how they do ?

Search for the IP address using your favorite search engine.


A return code that indicates the remote host may access resources could mean a risk but that's not a given, it's only by taking all things into account you see what behavior the host has.


Depending on access patterns, four lines being not enough really, it's likely automated scanning for common resources, not a thought out attack.

Dear Unspawn,
Yes I search and got this link http://www.projecthoneypot.org/ip_103.246.38.196. So I guess we got to see the return 200 and then map with other behavior to ascertain if its legitimate or not ? I guess this is challenging rite. Actually can a scrapper know what are the directories available in my server from /var/www/html ? This scraper first when to one of my main directory and then only the kooltabs.