I'm developing a personal project and one part of the project is a php website, hosted at hostinger as a free plan, that allow clients to ping to it and stores the WAN IP and the NAT IP of them.

They can ping to the web page just making a GET request to: mywebsite/ping.php?ip=XXX.XXX.XXX.XXX&description=USERNAME

where 'ip' is the NAT IP and 'description' is a parameter to store the name of the user.

// Snippet of ping.php
// obs.: didn't handled the inputs in a correct way because I'm just testing
$real_ip = $_SERVER ['REMOTE_ADDR'];
$ip = isset($_GET ['ip']) ? $_GET ['ip'] : ''; 
$description = isset($_GET ['description']) ? $_GET ['description'] : '';

if (!empty($ip)) {
            // If ip is not set or empty, do not save anything
        // saves the ip (nat), description and the real ip  into database
        // do nothing

My website is up and running. I tested it and it saves my real and local ip. I also created a php file to see a list of all clients that ping the server.

The mistery

I deployed the website online yesterday and made some tests pinging to it. It stored my IP ok. Today I stopped working on it a little bit and when I was back I realized that 10 different IPs pinged my ping.php file with the 'ip' parameter set to their local NAT IP. See the IP's list here

During the time that I was off I'm sure that none of my client programs pinged to the file since my PC was shutdown. Also the IPs found (real IP, not NAT) were all different from mine (mine didn't change until the time I checked the ghost IPs).

Question: How is that possible someone reach a php file on web and make a request using the righ parameters since just me and god knows about the existence of this php file on my web server?

Additional information

  • In my .htaccess located in htm_public, I disabled the indexing.
  • Nobody but me accessed my hostinger account
  • There is no index or default page on my web server, just the ping.php and show_all_ips.php
  • I tried some Google dorks to find my ping.php file but couldn't find anything
  • Do these IPs, by any chance, belong to Google or Akamai ? Are you using Chrome ?
    – Stephane
    Jun 3, 2014 at 12:32
  • Here ([s2.postimg.org/ev0uayvkp/print.png]) is the list of IP's that pinged. First is mine (ID = 36). I tried who.is website to get more details but couldn't retrieve anything important (at least for me). I don't think they're from google, @Stephane Jun 3, 2014 at 12:54
  • Some times I use Chrome to acces the ping.php just for test. Could Chrome "store" the url with parameters that I use and give it to google "bots" access it for any purpose? I found out that one of these IPs ( belongs to Google who.is/whois-ip/ip-address/ The list of IPs keeps increasing... Jun 3, 2014 at 13:05
  • What happens if you put a No Access to this script in your robots.txt file? I have a feeling that web crawlers are indexing your script. Hence the increasing amount of IP addresses.
    – Darren
    Sep 16, 2014 at 0:03

1 Answer 1


The IP addresses seem to belong to a plethora pf european ISPs/data centers: inetnum: - netname: NEOSTRADA-ADSL descr: Neostrada Plus descr: Warszawa country: PL

inetnum: - netname: HOSTEAM-1 descr: HOSTEAM S.C. country: PL

inetnum: - netname: DTAG-DIAL22 descr: Deutsche Telekom AG org: ORG-DTAG1-RIPE country: DE

inetnum: - netname: MTU-PPPOE descr: Comstar-Direct CJSC descr: Mamonovskij pereulok d.5 descr: P.O. BOX 38 123001 descr: Moscow, Russia country: RU

This one should be google's NetRange: - CIDR: NetName: LVLT-ORG-8-8 NetHandle: NET-8-0-0-0-1 NetType: Direct Allocation OrgName: Level 3 Communications, Inc. OrgId: LVLT Address: 1025 Eldorado Blvd. City: Broomfield StateProv: CO PostalCode: 80021 Country: US

A couple of suggestions, you pasted the url with the IP parameter set somewhere and it's ended up on a webpage and being crawled as previously suggested. Other examples is that you pasted it somewhere where non public robots are validating the page. Examples of this is antivirus scanners, so pasting it in skype/emails could account for the traffic. Lastly, it could be side effects of having malware on your computer, but judging by the source IPs that hit your page I think that is unlikely.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .