Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm developing a personal project and one part of the project is a php website, hosted at hostinger as a free plan, that allow clients to ping to it and stores the WAN IP and the NAT IP of them.

They can ping to the web page just making a GET request to: mywebsite/ping.php?ip=XXX.XXX.XXX.XXX&description=USERNAME

where 'ip' is the NAT IP and 'description' is a parameter to store the name of the user.

// Snippet of ping.php
// obs.: didn't handled the inputs in a correct way because I'm just testing
$real_ip = $_SERVER ['REMOTE_ADDR'];
$ip = isset($_GET ['ip']) ? $_GET ['ip'] : ''; 
$description = isset($_GET ['description']) ? $_GET ['description'] : '';

if (!empty($ip)) {
            // If ip is not set or empty, do not save anything
        // saves the ip (nat), description and the real ip  into database
}
else
{
        // do nothing
}

My website is up and running. I tested it and it saves my real and local ip. I also created a php file to see a list of all clients that ping the server.


The mistery

I deployed the website online yesterday and made some tests pinging to it. It stored my IP ok. Today I stopped working on it a little bit and when I was back I realized that 10 different IPs pinged my ping.php file with the 'ip' parameter set to their local NAT IP. See the IP's list here

During the time that I was off I'm sure that none of my client programs pinged to the file since my PC was shutdown. Also the IPs found (real IP, not NAT) were all different from mine (mine didn't change until the time I checked the ghost IPs).

Question: How is that possible someone reach a php file on web and make a request using the righ parameters since just me and god knows about the existence of this php file on my web server?

Additional information

  • In my .htaccess located in htm_public, I disabled the indexing.
  • Nobody but me accessed my hostinger account
  • There is no index or default page on my web server, just the ping.php and show_all_ips.php
  • I tried some Google dorks to find my ping.php file but couldn't find anything
share|improve this question
    
Do these IPs, by any chance, belong to Google or Akamai ? Are you using Chrome ? –  Stephane Jun 3 at 12:32
    
Here ([s2.postimg.org/ev0uayvkp/print.png]) is the list of IP's that pinged. First is mine (ID = 36). I tried who.is website to get more details but couldn't retrieve anything important (at least for me). I don't think they're from google, @Stephane –  arthurspa Jun 3 at 12:54
    
Some times I use Chrome to acces the ping.php just for test. Could Chrome "store" the url with parameters that I use and give it to google "bots" access it for any purpose? I found out that one of these IPs (8.35.201.53) belongs to Google who.is/whois-ip/ip-address/8.35.201.53 The list of IPs keeps increasing... –  arthurspa Jun 3 at 13:05
    
What happens if you put a No Access to this script in your robots.txt file? I have a feeling that web crawlers are indexing your script. Hence the increasing amount of IP addresses. –  Darren Sep 16 at 0:03

1 Answer 1

The IP addresses seem to belong to a plethora pf european ISPs/data centers: inetnum: 83.31.0.0 - 83.31.255.255 netname: NEOSTRADA-ADSL descr: Neostrada Plus descr: Warszawa country: PL

inetnum: 178.217.184.0 - 178.217.191.255 netname: HOSTEAM-1 descr: HOSTEAM S.C. country: PL

inetnum: 91.0.0.0 - 91.23.255.255 netname: DTAG-DIAL22 descr: Deutsche Telekom AG org: ORG-DTAG1-RIPE country: DE

inetnum: 91.78.0.0 - 91.79.255.255 netname: MTU-PPPOE descr: Comstar-Direct CJSC descr: Mamonovskij pereulok d.5 descr: P.O. BOX 38 123001 descr: Moscow, Russia country: RU

This one should be google's NetRange: 8.0.0.0 - 8.255.255.255 CIDR: 8.0.0.0/8 NetName: LVLT-ORG-8-8 NetHandle: NET-8-0-0-0-1 NetType: Direct Allocation OrgName: Level 3 Communications, Inc. OrgId: LVLT Address: 1025 Eldorado Blvd. City: Broomfield StateProv: CO PostalCode: 80021 Country: US

A couple of suggestions, you pasted the url with the IP parameter set somewhere and it's ended up on a webpage and being crawled as previously suggested. Other examples is that you pasted it somewhere where non public robots are validating the page. Examples of this is antivirus scanners, so pasting it in skype/emails could account for the traffic. Lastly, it could be side effects of having malware on your computer, but judging by the source IPs that hit your page I think that is unlikely.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.