IIS 404 Error — Page Not Found

What This Means

Analyze IIS HTTP 404 Not Found errors. Distinguish between benign broken links and active reconnaissance where attackers probe your web server for vulnerabilities.

Example Log

2026-03-08 16:05:12 W3SVC1 WEB01 10.0.1.50 GET /wp-login.php - 443 - 198.51.100.77 Mozilla/5.0 - 404 0 2 187

Indicators of Suspicious Activity

• 404 requests targeting CMS-specific paths (/wp-login.php, /administrator, /wp-admin)
• Requests for common vulnerability paths (/phpmyadmin, /.env, /actuator, /config.php)
• High 404 rate from a single IP suggesting automated directory bruteforcing
• 404 requests with suspicious query strings containing SQL or script fragments
• Requests for paths associated with known exploits or CVEs
• Scanning patterns — sequential probing of common paths in alphabetical order

How to Investigate

1. Filter IIS logs for 404 responses and group by client IP to identify scanners
2. Review the requested URIs for vulnerability scanning patterns
3. Check if the scanned paths correspond to any actual applications on the server
4. Correlate the scanning IP with threat intelligence feeds
5. Review if any 404 patterns transition to 200/301 indicating discovered content
6. Check server response times — slow 404s may indicate server-side processing of malicious input

Recommended Mitigations

• Return generic custom 404 pages that do not reveal server technology or framework
• Implement rate limiting to throttle excessive 404 requests from single IPs
• Block known vulnerability scanner User-Agent strings at the WAF
• Use IIS Request Filtering to reject requests for non-existent file extensions
• Monitor and alert on IPs generating more than 50 404s per minute
• Consider deploying a honeypot path that triggers alerts when accessed

Related Log Types

Related Attack Patterns

Frequently Asked Questions