New answers tagged iis
as @GZBK said, this happens because for whatever reason, people are being sent to your server when they try to open those sites. This has happened to many others, and is likely the GFW doing its dirty thing. Here is a nice post about some other guy who had the same thing happen to him. You can use this site to check if the dns is pointed to your server.
Since GZBK covered why, I will cover the single simple solution to minimize this and related problems that I and others such as StevenC use. Make your first or default virtual host small fast and light, returning errors on all requests (I have been known to allow a basic css and related resources). This has the advantage of minimizing resource consumption, ...
When you type the URL in your browser, the browser will mainly do two things with it: Resolve the host name to get the associated IP address to be contacted, this allow the browser to send the request to the right server, Put the host name which has been actually typed in the Host HTTP header, this allows the server to send an appropriate reply in case ...
You will not see the payload in the logs If the attacks were sent via a POST, as opposed to a GET.
As far as I know there is no way to avoid being logged by the web server exploiting a SQLi vulnerability since you have to reach the DB and check webserver output in order to validate SQLi result, specially in a blind SQL injection. Also if you registered 18000 requests from the attacker he should be using an automated tool which use to check web page ...
Top 50 recent answers are included