Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
So logging all the requests I get things like this:
Mon Sep 07 2015 21:30:04 GMT+0200 (CEST) Received request for http://testp4.pospr.waw.pl/testproxy.php
also for http://zc.qq.com/cgi-bin/common/attr?id=260714&r=0.9927029395516237
My simple server:
var server = http.createServer(function(request, response) {
console.log((new Date()) + ' Received request for ' + request.url);
response.writeHead(404);
response.end();
});
Should I worry? What could that be?
What you're seeing is an "open proxy" test: your webserver is being scanned to see if it can be used as a general-purpose HTTP proxy.
The requests are not something to worry about in and of themselves, but they reveal a weakness in your server: you're not logging what response the server makes to the request. It should be a "404 not found", but you don't have the log entries to prove it.
GET http://zc.qq.com/cgi-bin/chs/numreg/init?, and my server appears to respond with a 200 status code. I'm a bit confused as to how it can receive a request for a domain that it doesn't serve and how it is responding with a 200 status code. Any thoughts most welcome, thanks.
– iss42
Dec 30 '15 at 23:22
<VirtualHost *:80>. You may also try to access http://(server ip address)cgi-bin/chs/numreg/init? and see if that serves you content or an error
– Hagen von Eitzen
Jan 24 '16 at 18:30
/cgi-bin/chs/numreg/init on zc.qq.com, it's a request for a local page named http://zc.qq.com/cgi-bin/chs/numreg/init. Your server is probably configured to return a generic page (such as the root page or a site index) when the requested page does not exist, rather than a 404 error.
– Mark
Jan 24 '16 at 20:05
