Odd non existant 404 files

[Parrot]

I was checking my AWStats. The 404 listing included the three lines below (my site is xyx.com).
The first is just an non existent page but the 2nd and third seem to indicate pages (kytaf.shtml and fidouhi.pl) on my server.
I checked with a file listing to show hidden files but they are not there.
Anyone else seen anything like this?
Is there a method that has been used to hide them? (it is a UNIX host)

/page4.html 1 -
/soopemoop/bilou/voovyvuc.shtml 1 http://www.xyz.com/kytaf.shtml
/quurylico/boopoocetouf/koobeg.shtml 1 http://www.xyz.com/fidouhi.pl

[Chris]

I'm not sure exactly what you are asking, but automatic worms regularly try to access nonexistant files on most web servers, so you see it all the time.

[Parrot]

Thanks for that, the thing is that the referrer page,
http://www.xyz.com/kytaf.shtml
for the missing file: /soopemoop/bilou/voovyvuc.shtml
is not on the server so how are the stats picking it up?

Interestingly, if I type a non existant file name after http://www.xyz.com I get the expected 404 but if I type http://www.xyz.com/kytaf.shtml
the browser hangs.

[Chris]

The referer doesn't exist and the file itself doesn't exist?

Referers can be spoofed as well.

[Parrot]

Thanks, had not considered that. The only reason I can think of to spoof a referrer would be to obtain privileges if the web server thought it was executing one of it's own pages.
So would this suggest someone randomly running it against servers to find those that had not been properly secured?

[Blue Cat Buxton]

I think so - the bot sees an extension on one site and tries it on others, or tries to guess an extension. I have seen similar on my sites.