25

I am running a Centos7 web server. I noticed a few strange HTTP GET requests like these:

94.185.83.100 - - [29/Feb/2016:23:29:00 +0530] "GET http://testp1.piwo.pila.pl/testproxy.php HTTP/1.1" 404 390 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/31.0"
185.25.151.159 - - [01/Mar/2016:07:36:40 +0530] "GET http://testp1.piwo.pila.pl/testproxy.php HTTP/1.1" 404 390 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/31.0"
  1. I have no connection to the domain piwo.pila.pl. How did it end up in my Apache access_log?
  2. In the error_log document, the same document is given under my web root, i.e.: [Mon Feb 29 23:29:00.175813 2016] [:error] [pid 11382] [client 94.185.83.100:43718] script 'myWebRoot/testproxy.php' not found or unable to stat Is this expected behavior? That the access_log keeps a record of the exact request while the error_log tracks the same request but translated to a URL on the file system?
Improve this question
2
  • 1
    I asked a very similar question here. The answer really helped me to understand why this happens and how it works.
    – Zachary Dow
    Mar 4, 2016 at 16:14
  • @ZacharyDow: Thank you for that link. That was helpful.
    – Sriram
    Mar 7, 2016 at 9:54

1 Answer 1

Reset to default
34

Your website has been hit by an automated script that looks for open proxies on the internet. The url it's trying to access would record a successful proxied request and add your server to a list.

Improve this answer
3
  • thank you for your reply. but how does a request to piwo.pila end up on my server? How and where has that "mapping" been done? Also, is the error_log path correct, I mean is that how it is supposed to look?
    – Sriram
    Mar 4, 2016 at 11:47
  • 41
    Anyone can connect to a web server and request any host at all. It's like asking why someone calls your phone number and asks for the wrong person.
    – Jenny D
    Mar 4, 2016 at 11:52
  • @wireghoul: thanks. Your answer and the other links helped out quite a bit.
    – Sriram
    Mar 7, 2016 at 9:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .