Most of the time when I am looking for
404 errors in my
access.log, I see attempts to access something like
/phpMyAdmin/scripts/setup.php. This does not bother me so much, but few days ago I was surprised because I saw this in my access.log
220.127.116.11 - - [19/Aug/2013:11:30:31 +0000] "GET http://server7.cyberpods.net/azenv.php HTTP/1.1" 404 3080 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:18.104.22.168) Gecko/20120306 Firefox/3.6.28 (.NET CLR 3.5.30729)" 22.214.171.124 - - [21/Aug/2013:00:55:46 +0000] "GET http://www.baidu.com/ HTTP/1.1" 404 3080 "http://www.baidu.com/" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)"
What surprises me is that someone is trying to access not some relevant URL on my domain, but something absolutely different.
I have two questions:
- How are they doing it?
- What is the reason behind it?