Specific analysis for 404 codes

The 404 code (not found) indicates:

• URL is incorrectly written by the visitor. This could be due to a URL wrongly typed or a deliberate intent to search for hidden pages or security holes in our website (which could be described as "pre-attack").
• URL that does not exist in our website (dead links).

Identifying the source IP of these movements can help to perform protective measures, if necessary.

1. Access the demo.ecommerce.data again to create a new query.
2. First, you have to isolate the events whose status code is 404 by applying a filter and using the Equal (eq, =) operation. You can do this in two different ways:
   • Selecting a cell with the 404 value in the statusCode column and hitting the ENTER key. The Equal (eq, =) operation is selected by default, and the arguments are filled with the column and value selected.
   • Clicking the Filter icon from the query window toolbar. The Equal (eq, =) operation is selected by default. Select New argument twice to add two arguments. Select the statusCode column in the Value argument, and enter 404 in the is equal to argument.
   • 
3. Now you can analyze the content of the column referralUri, which indicates the address of the website that created the link to the resource being requested. Hover over the column header and select the arrow icon that appears to see the percentage of each distinct value in the column.
   
   

There is a certain percentage of cases where the referrer is the own website (www.logcasts.com). This means that the user is trying unsuccessfully to access a particular web resource addressed by the website itself and indicates that there is some kind of problem on that link. This might indicate that the website contains dead links or typos. When the referrer is external to our website, it might indicate either wrong links or potential attacks looking for vulnerable pages.