2

I have been receiving some strange requests on my website from foreign countries. For example, 218.83.152.252/judge112233.php, /www.travelimgusa.com/ip.php, //59.53.91.9/httpproxy/proxyheader.php, /w00tw00t.at.ISC.SANS.DFind:) and they are all giving the status code 200. I've got no idea what all this means. It's an e-commerce site and its powered by OpenCart if that helps. Hoping someone can help me out!

Have had another look at the reports through Logaholic and have noticed that the code 200 requests were before the hosting company set up a dedicated IP and SSL certificate for me. After it was set up the requests have 404 codes. So I think it's OK. Sorry to be a pain!

| improve this question | |
  • You should update your question with more accurate logging. Copy and paste the whole line you refer to into your question. – jippie Jun 14 '12 at 17:25
  • BTW: some webapps manage to serve all/most requests with a 200 response, whether it is a valid request or not. – jippie Jun 14 '12 at 17:28
5

There is nothing to worry about. Tons of web-crawlers are bombarding our websites with requests like that. Probably they are trying to figure out if someone uploaded web-shells (and renamed them as judge112233.php, ip.php, etc.) to your server.

Just make sure that your server hasn't got these files.

| improve this answer | |
1

It would have been helpful if you'd showed us the actual logs. It looks like someone is scanning your site for an open web proxy, and (since there are 200 responses) that you are indeed running an open proxy.

Most people will be aware of the dangers of running an open SMTP relay, running an open web proxy is even worse: the person making these requests is trying to find a way to access these sites in a way which is very difficult to trace. Often you'll see discussions of oppressive regimes and right to anonymity, but in practice, all such traffic I see has criminal intent. To the victim you appear to be the perpetrator / facilitator.

You are right to be concerned, and thank you for checking your log files.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.