`data/yolo-overnight/static-404s-20260525-1330.md`

67 lines
# Static 404 Audit — wallco.ai

**Generated:** 2026-05-25 13:30 UTC
**Log source:** `/var/log/nginx/access.log` + `/var/log/nginx/access.log.1` (today + yesterday, ~600K lines combined)
**Note:** Task spec said `logs/server.out.log, last 5000 lines`, but the wallco-ai PM2 stdout log (`/root/.pm2/logs/wallco-ai-out.log`, 125 lines total) contains no HTTP request data — only app stdout. Switched to nginx access logs, which are the actual source of HTTP status codes for wallco.ai. Project-local `logs/` directory contains only batch-job JSONLs (bulk-bg-swap, ghost-rescan), no request log.

**Filter:** `GET` requests matching `/designs/img/`, `/designs/room/`, or `/uploads/` with status `404`.

---

## Summary

| Bucket | Unique paths | Total 404 hits |
|---|---|---|
| `/designs/img/` (real broken asset) | 1 | 68 |
| `/designs/room/` | 0 | 0 |
| `/uploads/` (bot probes / scanner traffic) | 5 | 166 |
| **Total** | **6** | **234** |

`/designs/room/` had zero 404s in window (only 2 successful 200s observed).

---

## Bucket 1 — Real broken asset (`/designs/img/`)

Single missing file, hit 68 times — all from Steve's IP (`76.33.146.135`), Chrome 148 on macOS. No bot traffic. Looks like a broken `<img>` reference on an internal page.

| Hits | Path | Source IP | UA |
|---|---|---|---|
| 68 | `/designs/img/var_41538_hue-60_1779692961993.png` | 76.33.146.135 | Chrome 148 / macOS |

**Decoded:** design id `41538`, hue-shifted variant `-60`, cache-bust `1779692961993` (~May 20). Generator probably failed to write the hue-shifted PNG, but the page is still referencing it. Action: either regenerate variant 41538/hue-60 or strip the broken `<img>` from whichever component is rendering it. Worth checking `data/designs/img/` on the prod box for `var_41538_*.png` to see which hue variants did succeed.

## Bucket 2 — Bot / scanner probes (`/uploads/`)

All `/uploads/` 404s are external scanners hunting for vulnerable PHP/upload directories. Top probing IPs: `20.9.45.132`, `52.139.38.60`, `20.195.178.143`, `172.202.92.73` (all Microsoft Azure cloud ranges — typical scanner infrastructure).

| Hits | Path | Notes |
|---|---|---|
| 91 | `/uploads/` | directory-listing probe |
| 65 | `/uploads/.env` | secrets-hunting |
| 8 | `/uploads/index.php` | PHP-shell probe |
| 1 | `/uploads/filemanager/dialog.php` | filemanager exploit |
| 1 | `/uploads/auth.json` | credential probe |

**Action:** None required — these are background internet noise. Optional: add nginx-level `return 444` for `/uploads/.env`, `/uploads/*.php`, `/uploads/auth.json` to stop them hitting the Node app at all. Could also drop the offending Azure ranges via UFW, but that's whack-a-mole.

---

## Source IP breakdown (404s on the three buckets)

| IP | Hits | Notes |
|---|---|---|
| 76.33.146.135 | 68 | Steve — broken design variant |
| 20.9.45.132 | 21 | Azure scanner |
| 52.139.38.60 | 17 | Azure scanner |
| 20.195.178.143 | 14 | Azure scanner |
| 172.202.92.73 | 12 | Azure scanner |
| 20.116.59.164 | 9 | Azure scanner |
| (others) | 93 | misc scanners |

---

## Recommended next step

Only one real bug here: design `41538` is missing its `hue-60` variant PNG. Worth a follow-up to either (a) regenerate via the hue-shift pipeline, or (b) find the consumer page and remove the dead reference.