Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running a Centos7 web server. I noticed a few strange HTTP GET requests like these:

94.185.83.100 - - [29/Feb/2016:23:29:00 +0530] "GET http://testp1.piwo.pila.pl/testproxy.php HTTP/1.1" 404 390 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/31.0"
185.25.151.159 - - [01/Mar/2016:07:36:40 +0530] "GET http://testp1.piwo.pila.pl/testproxy.php HTTP/1.1" 404 390 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/31.0"  
  1. I have no connection to the domain piwo.pila.pl. How did it end up in my Apache access_log?
  2. In the error_log document, the same document is given under my web root, i.e.: [Mon Feb 29 23:29:00.175813 2016] [:error] [pid 11382] [client 94.185.83.100:43718] script 'myWebRoot/testproxy.php' not found or unable to stat Is this expected behavior? That the access_log keeps a record of the exact request while the error_log tracks the same request but translated to a URL on the file system?
share|improve this question
1  
I asked a very similar question here. The answer really helped me to understand why this happens and how it works. – Zachary Dow Mar 4 at 16:14
    
@ZacharyDow: Thank you for that link. That was helpful. – Sriram Mar 7 at 9:54
up vote 23 down vote accepted

Your website has been hit by an automated script that looks for open proxies on the internet. The url it's trying to access would record a successful proxied request and add your server to a list.

share|improve this answer
    
thank you for your reply. but how does a request to piwo.pila end up on my server? How and where has that "mapping" been done? Also, is the error_log path correct, I mean is that how it is supposed to look? – Sriram Mar 4 at 11:47
32  
Anyone can connect to a web server and request any host at all. It's like asking why someone calls your phone number and asks for the wrong person. – Jenny D Mar 4 at 11:52
    
@wireghoul: thanks. Your answer and the other links helped out quite a bit. – Sriram Mar 7 at 9:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.