24

I am running a Centos7 web server. I noticed a few strange HTTP GET requests like these:

94.185.83.100 - - [29/Feb/2016:23:29:00 +0530] "GET http://testp1.piwo.pila.pl/testproxy.php HTTP/1.1" 404 390 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/31.0"
185.25.151.159 - - [01/Mar/2016:07:36:40 +0530] "GET http://testp1.piwo.pila.pl/testproxy.php HTTP/1.1" 404 390 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/31.0"  
  1. I have no connection to the domain piwo.pila.pl. How did it end up in my Apache access_log?
  2. In the error_log document, the same document is given under my web root, i.e.: [Mon Feb 29 23:29:00.175813 2016] [:error] [pid 11382] [client 94.185.83.100:43718] script 'myWebRoot/testproxy.php' not found or unable to stat Is this expected behavior? That the access_log keeps a record of the exact request while the error_log tracks the same request but translated to a URL on the file system?
  • 1
    I asked a very similar question here. The answer really helped me to understand why this happens and how it works. – Zachary Dow Mar 4 '16 at 16:14
  • @ZacharyDow: Thank you for that link. That was helpful. – Sriram Mar 7 '16 at 9:54
32

Your website has been hit by an automated script that looks for open proxies on the internet. The url it's trying to access would record a successful proxied request and add your server to a list.

  • thank you for your reply. but how does a request to piwo.pila end up on my server? How and where has that "mapping" been done? Also, is the error_log path correct, I mean is that how it is supposed to look? – Sriram Mar 4 '16 at 11:47
  • 39
    Anyone can connect to a web server and request any host at all. It's like asking why someone calls your phone number and asks for the wrong person. – Jenny D Mar 4 '16 at 11:52
  • @wireghoul: thanks. Your answer and the other links helped out quite a bit. – Sriram Mar 7 '16 at 9:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.