'Ghost' access to a php file on a web server

Question

I'm developing a personal project and one part of the project is a php website, hosted at hostinger as a free plan, that allow clients to ping to it and stores the WAN IP and the NAT IP of them.

They can ping to the web page just making a GET request to: mywebsite/ping.php?ip=XXX.XXX.XXX.XXX&description=USERNAME

where 'ip' is the NAT IP and 'description' is a parameter to store the name of the user.

// Snippet of ping.php
// obs.: didn't handled the inputs in a correct way because I'm just testing
$real_ip = $_SERVER ['REMOTE_ADDR'];
$ip = isset($_GET ['ip']) ? $_GET ['ip'] : ''; 
$description = isset($_GET ['description']) ? $_GET ['description'] : '';

if (!empty($ip)) {
            // If ip is not set or empty, do not save anything
        // saves the ip (nat), description and the real ip  into database
}
else
{
        // do nothing
}

My website is up and running. I tested it and it saves my real and local ip. I also created a php file to see a list of all clients that ping the server.

---

The mistery

I deployed the website online yesterday and made some tests pinging to it. It stored my IP ok. Today I stopped working on it a little bit and when I was back I realized that 10 different IPs pinged my ping.php file with the 'ip' parameter set to their local NAT IP. See the IP's list here

During the time that I was off I'm sure that none of my client programs pinged to the file since my PC was shutdown. Also the IPs found (real IP, not NAT) were all different from mine (mine didn't change until the time I checked the ghost IPs).

Question: How is that possible someone reach a php file on web and make a request using the righ parameters since just me and god knows about the existence of this php file on my web server?

Additional information

• In my .htaccess located in htm_public, I disabled the indexing.
• Nobody but me accessed my hostinger account
• There is no index or default page on my web server, just the ping.php and show_all_ips.php
• I tried some Google dorks to find my ping.php file but couldn't find anything

Answer 1

The IP addresses seem to belong to a plethora pf european ISPs/data centers: inetnum: 83.31.0.0 - 83.31.255.255 netname: NEOSTRADA-ADSL descr: Neostrada Plus descr: Warszawa country: PL

inetnum: 178.217.184.0 - 178.217.191.255 netname: HOSTEAM-1 descr: HOSTEAM S.C. country: PL

inetnum: 91.0.0.0 - 91.23.255.255 netname: DTAG-DIAL22 descr: Deutsche Telekom AG org: ORG-DTAG1-RIPE country: DE

inetnum: 91.78.0.0 - 91.79.255.255 netname: MTU-PPPOE descr: Comstar-Direct CJSC descr: Mamonovskij pereulok d.5 descr: P.O. BOX 38 123001 descr: Moscow, Russia country: RU

This one should be google's NetRange: 8.0.0.0 - 8.255.255.255 CIDR: 8.0.0.0/8 NetName: LVLT-ORG-8-8 NetHandle: NET-8-0-0-0-1 NetType: Direct Allocation OrgName: Level 3 Communications, Inc. OrgId: LVLT Address: 1025 Eldorado Blvd. City: Broomfield StateProv: CO PostalCode: 80021 Country: US

A couple of suggestions, you pasted the url with the IP parameter set somewhere and it's ended up on a webpage and being crawled as previously suggested. Other examples is that you pasted it somewhere where non public robots are validating the page. Examples of this is antivirus scanners, so pasting it in skype/emails could account for the traffic. Lastly, it could be side effects of having malware on your computer, but judging by the source IPs that hit your page I think that is unlikely.