After recently having my shared-host linux server hacked (~25 WordPress installs, malicious code spidered throughout), I've started looking through my access log files to see where my traffic is coming from (was hoping to narrow down the point of entry, having minimal luck).I keep seeing entries where I can verify the Referrer does not exist. For example:103.47.135.111 - - [19/Apr/2016:01:14:53 -0600] GET /wp-content/themes/wallstreet/style.css?ver=4.5 HTTP/1.1 200 12562 http://my_domain.com/yqmmfkv/Cara-pdkt-sama-cewek-lewat-hp.htm Mozilla/5.0 (iPhone; CPU iPhone OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML, like Gecko) Version/7.0 Mobile/11D257 Safari/9537.53The referrer (http://my_domain.com/yqmmfkv/Cara-pdkt-sama-cewek-lewat-hp.htm) doesn't exist from what I can tell. It returns a 404, there's no mention of it using grep -r yqmmfkv, and doesn't seem to exist in my WP database. The style.css file does exist so I see why it's returning 200, but how can a page that doesn't exist be requesting it?Further, what's the gain by spoofing the referrer?
Apache Log file - Referer URL that doesn't exist
logs