Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I receive a lot of requests like this: 110.249.208.XXX - - [11/Dec/2013:10:27:17 +0000] 
"GET HTTP/1.1" 200 9515 
"" "Mozilla/5.0 (w3660t by Kev++)"

I don't understand what this request want. And what can I do against it using Apache. Currently it seems they are all coming from the same IP address block. I'm using a AWS server. I have some proxy functionality enabled on Apache.

share|improve this question 110.249.208.XXX - - [11/Dec/2013:10:27:17 +0000] "GET HTTP/1.1" 200

They are fishing for an open HTTP proxy, and your 200 response code says they found one.

By operating an open proxy, you're enabling people to launch any number of web attacks through you; it's even worse if you don't include X-Forwarded-For headers with their source IP. Do you really want to enable other people's (potentially harmful) activity with your web server?

If you must keep proxy functionality on the server and want to stop the abuse, at least configure it with one or more of:

  • HTTP Authentication
  • An IP ACL which limits proxied traffic to a trusted block of IPs (incorporating Shadur's comment)
share|improve this answer
Or at the very least configure an IP-based access control list. – Shadur Dec 11 '13 at 12:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.