1

I'm developing APIs for my front-end mobile app to consume, and I'm hosting it on my AWS server, which is public accessible. I leave the development environment API for one day. Today I noticed some unknown requests, but what are they trying to do?

morgan logged all these request

::ffff:95.25.125.123 - - [20/Mar/2017:16:07:06 +0000] "GET http://t9.proxy-checks.com/favicon.ico HTTP/1.1" 404 39 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
::ffff:95.25.125.123 - - [20/Mar/2017:16:07:06 +0000] "POST http://t9.proxy-checks.com/favicon.ico HTTP/1.1" 404 39 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
::ffff:95.25.125.123 - - [20/Mar/2017:16:07:06 +0000] "GET http://46.148.21.14/favicon.ico HTTP/1.1" 404 39 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
::ffff:95.25.125.123 - - [20/Mar/2017:16:07:09 +0000] "POST http://t19.proxy-checks.com/favicon.ico HTTP/1.1" 404 39 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
::ffff:95.25.125.123 - - [20/Mar/2017:16:08:46 +0000] "GET http://t5.proxy-checks.com/favicon.ico HTTP/1.1" 404 39 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
::ffff:95.25.125.123 - - [20/Mar/2017:16:08:46 +0000] "POST http://t5.proxy-checks.com/favicon.ico HTTP/1.1" 404 39 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
::ffff:95.25.125.123 - - [20/Mar/2017:16:08:46 +0000] "GET http://46.38.62.196/favicon.ico HTTP/1.1" 404 39 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
::ffff:95.25.125.123 - - [20/Mar/2017:16:08:52 +0000] "POST http://t1.proxy-checks.com/favicon.ico HTTP/1.1" 404 39 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
::ffff:58.182.10.224 - - [20/Mar/2017:16:10:03 +0000] "GET /category/en HTTP/1.1" 200 406713 "-" "SmartPad/1.0 (me.caoyang.SmartPad; build:1; iOS 9.3.5) Alamofire/4.4.0"
::ffff:185.25.148.240 - - [20/Mar/2017:16:40:48 +0000] "GET http://testp3.pospr.waw.pl/testproxy.php HTTP/1.1" 404 39 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/31.0"
::ffff:191.96.249.97 - - [20/Mar/2017:17:44:40 +0000] "GET /setup.cgi HTTP/1.1" 404 39 "-" "-"
::ffff:212.47.227.163 - - [20/Mar/2017:17:54:08 +0000] "GET http://www.bing.com HTTP/1.1" 200 44 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
::ffff:163.172.168.251 - - [20/Mar/2017:21:20:31 +0000] "GET http://www.bing.com HTTP/1.1" 200 44 "-" "Chrome/41.0.2228.0 Safari/537.36"
::ffff:163.172.168.251 - - [21/Mar/2017:03:13:36 +0000] "GET http://www.bing.com HTTP/1.1" 200 44 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.1"
::ffff:95.25.125.123 - - [21/Mar/2017:04:15:26 +0000] "GET http://t6.proxy-checks.com/favicon.ico HTTP/1.1" 404 39 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
::ffff:95.25.125.123 - - [21/Mar/2017:04:15:26 +0000] "POST http://t6.proxy-checks.com/favicon.ico HTTP/1.1" 404 39 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
::ffff:95.25.125.123 - - [21/Mar/2017:04:15:26 +0000] "GET http://158.58.168.237/favicon.ico HTTP/1.1" 404 39 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
::ffff:95.25.125.123 - - [21/Mar/2017:04:15:29 +0000] "POST http://t11.proxy-checks.com/favicon.ico HTTP/1.1" 404 39 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
::ffff:95.25.125.123 - - [21/Mar/2017:04:16:12 +0000] "GET http://t8.proxy-checks.com/favicon.ico HTTP/1.1" 404 39 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
::ffff:95.25.125.123 - - [21/Mar/2017:04:16:12 +0000] "POST http://t8.proxy-checks.com/favicon.ico HTTP/1.1" 404 39 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
::ffff:95.25.125.123 - - [21/Mar/2017:04:16:15 +0000] "GET http://37.235.53.161/favicon.ico HTTP/1.1" 404 39 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
::ffff:95.25.125.123 - - [21/Mar/2017:04:16:31 +0000] "POST http://t15.proxy-checks.com/favicon.ico HTTP/1.1" 404 39 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
::ffff:198.55.103.208 - - [21/Mar/2017:04:55:15 +0000] "GET /manager/html HTTP/1.1" 404 39 "-" "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)"
::ffff:91.196.50.33 - - [21/Mar/2017:05:05:19 +0000] "GET http://testp3.pospr.waw.pl/testproxy.php HTTP/1.1" 404 39 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/31.0"
::ffff:93.174.93.136 - - [21/Mar/2017:07:00:14 +0000] "GET http://www.baidu.com/cache/global/img/gs.gif HTTP/1.1" 404 39 "-" "Mozilla                                   "
::ffff:191.96.249.97 - - [21/Mar/2017:07:16:18 +0000] "GET /setup.cgi HTTP/1.1" 404 39 "-" "-"
::ffff:191.96.249.97 - - [21/Mar/2017:10:22:06 +0000] "GET /setup.cgi HTTP/1.1" 404 39 "-" "-"
::ffff:202.168.151.162 - - [21/Mar/2017:14:26:36 +0000] "GET //script HTTP/1.1" 404 39 "-" "python-requests/2.7.0 CPython/2.7.9 Windows/2003Server"
::ffff:47.203.88.36 - - [21/Mar/2017:14:39:44 +0000] "GET http://httpheader.net/ HTTP/1.1" 200 44 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.28) Gecko/20120306 Firefox/3.6.28 (.NET CLR 3.5.30729)"
::ffff:191.96.249.97 - - [21/Mar/2017:15:43:53 +0000] "GET /setup.cgi HTTP/1.1" 404 39 "-" "-"
::ffff:139.162.79.87 - - [21/Mar/2017:15:50:27 +0000] "GET / HTTP/1.1" 200 44 "-" "Mozilla/5.0"
::ffff:58.182.10.224 - - [21/Mar/2017:16:05:24 +0000] "GET /category/en HTTP/1.1" 200 406713 "-" "SmartPad/1.0 (me.caoyang.SmartPad; build:1; iOS 9.3.5) Alamofire/4.4.0"
::ffff:58.182.10.224 - - [21/Mar/2017:16:05:46 +0000] "GET /table HTTP/1.1" 200 515 "-" "SmartPad/1.0 (me.caoyang.SmartPad; build:1; iOS 9.3.5) Alamofire/4.4.0"
0

2 Answers 2

1

Anything that still claims to be MSIE 7.0 is a drive-by sniffer, looking for open admin panels and known faulty devices. These are basically un-avoidable and relatively harmless. Any web log has lots of entries from Romanian hackers, infosec researchers using massscan, etc. Nothing personal, they bother everyone. It can be disconcerting at first but it's perfectly normal and a good reminder to keep up with updates.

0

I don't know exactly what it is, the domain is down and search engines return very little info. But I'm certain no harm has been done; the domain is down and there's no machine to recieve the call. I've done a pingless port scan to see if there was something listening but being stealthy, but it really seems there is nothing there. I'd suggest using a good text editor to search for the proxy-checks.com domain in your code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.