-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On Mon, 20 Feb 2006 16:28:20 -0500 Kevin Coyner <[EMAIL PROTECTED]> wrote:
> > I've been watching the apache logs on a website I work on and have > seen strange entries recently. They are in Combined form, and here > is a snippet: > > 221.226.124.109 - - [20/Feb/2006:16:17:10 -0500] "GET > http://1-shops.com/prx.php?p=q1w2e3r4t5y6u7i8o9p0*a-b HTTP/1.1" 404 > 288 "http://www.google.com/intl/en-us/"; "Mozilla/4.0 (compatible; > MSIE 6.0; Windows NT 5.0; Crazy Browser 1.0.5)" > > > I interpret this as follows: > > Client IP: > 221.226.124.109 > > Page attempted: > http://1-shops.com/prx.php?p=q1w2e3r4t5y6u7i8o9p0*a-b > > HTTP error code: > 404 > > > Now the server I work on is in the IP range 64.34.x.x, and has > nothing to do with 1-shops.com. And the client - 221.226.124.109 - > that is hitting on my Apache server can be traced back to China. > > So what is this? They are not requesting pages that exist on my > server, but pages on other domains. My server gives the proper > error code back - 404. > > I normally wouldn't worry about this, but in the last month these > types of entries have increased dramatically, with most of them > originating from IP's in China. They're looking for open proxies. People that are lazy in loading/configuring mod_proxy in apache can easily turn a webserver into an open proxy. So they scan for one, similar to the way we've all seen attempts at finding open smtp gateways or easily crackable ssh passwords. HTH, Jacob -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.2 (GNU/Linux) iD8DBQFD+ov5kpJ43hY3cTURAqk7AJ9t6c84wtoEbYb0udKlnbCAtKPESQCdGDo0 fGnnK8qDa1Xe2eDdEcR5VI4= =L1Nc -----END PGP SIGNATURE-----
