Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm developing a personal project and one part of the project is a php website, hosted at hostinger as a free plan, that allow clients to ping to it and stores the WAN IP and the NAT IP of them.

They can ping to the web page just making a GET request to: mywebsite/ping.php?ip=XXX.XXX.XXX.XXX&description=USERNAME

where 'ip' is the NAT IP and 'description' is a parameter to store the name of the user.

// Snippet of ping.php
// obs.: didn't handled the inputs in a correct way because I'm just testing
$real_ip = $_SERVER ['REMOTE_ADDR'];
$ip = isset($_GET ['ip']) ? $_GET ['ip'] : ''; 
$description = isset($_GET ['description']) ? $_GET ['description'] : '';

if (!empty($ip)) {
            // If ip is not set or empty, do not save anything
        // saves the ip (nat), description and the real ip  into database
        // do nothing

My website is up and running. I tested it and it saves my real and local ip. I also created a php file to see a list of all clients that ping the server.

The mistery

I deployed the website online yesterday and made some tests pinging to it. It stored my IP ok. Today I stopped working on it a little bit and when I was back I realized that 10 different IPs pinged my ping.php file with the 'ip' parameter set to their local NAT IP. See the IP's list here

During the time that I was off I'm sure that none of my client programs pinged to the file since my PC was shutdown. Also the IPs found (real IP, not NAT) were all different from mine (mine didn't change until the time I checked the ghost IPs).

Question: How is that possible someone reach a php file on web and make a request using the righ parameters since just me and god knows about the existence of this php file on my web server?

Additional information

  • In my .htaccess located in htm_public, I disabled the indexing.
  • Nobody but me accessed my hostinger account
  • There is no index or default page on my web server, just the ping.php and show_all_ips.php
  • I tried some Google dorks to find my ping.php file but couldn't find anything
share|improve this question
Do these IPs, by any chance, belong to Google or Akamai ? Are you using Chrome ? –  Stephane Jun 3 at 12:32
Here ([s2.postimg.org/ev0uayvkp/print.png]) is the list of IP's that pinged. First is mine (ID = 36). I tried who.is website to get more details but couldn't retrieve anything important (at least for me). I don't think they're from google, @Stephane –  arthurspa Jun 3 at 12:54
Some times I use Chrome to acces the ping.php just for test. Could Chrome "store" the url with parameters that I use and give it to google "bots" access it for any purpose? I found out that one of these IPs ( belongs to Google who.is/whois-ip/ip-address/ The list of IPs keeps increasing... –  arthurspa Jun 3 at 13:05
What happens if you put a No Access to this script in your robots.txt file? I have a feeling that web crawlers are indexing your script. Hence the increasing amount of IP addresses. –  Darren Sep 16 at 0:03

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.