2

I set up nginx to serve from an Ubuntu EC2 instance a few days ago, and today I checked the error logs when I encountered 504 after 504 in the browser. I found the following in my error.log:

...
open() "/var/www/html/ip_json.php" failed (2: No such file or directory), 
client: 179.99.200.39, server: mydomain.com, 
request: "GET http://teddybrinkofski.com/ip_json.php HTTP /1.1", 
host: "www.teddybrinkofski.com", referrer: "none"
...

Do note that I have no php on this server (especially not a file called ip_json.php), and I am not (nor am I familiar in any way with) teddybrinkofski.com.

This sounds like bad news to me; possible compromised credentials? But it's also very possible that I've done something silly on this otherwise virgin machine. Whatever it is, I don't like that this foreign domain is on my machine. (grep'ing for the domain results in nothing meaningful, but I may not know what I should be looking for, so I'm happy to review the results with you.)

Regardless, it feels to me like my server thinks it should be pulling this file from a remote location, which is not too pleasing.

All input welcome, please let me know if I've forgotten something important.

3
  • It's OK. Welcome to wild wild web. Anyone could send any request to your server with any headers (and hostname is just another header in http request). Here someone tried to use your server as proxy. Probably they just mistyped their proxy server ip.
    – Alexey Ten
    Jul 9, 2014 at 6:25
  • Haha alright, sorry for crying wolf! That's very good to know. Thanks!
    – j6m8
    Jul 9, 2014 at 12:36
  • 1
    2 years later and I just received the same request. Bogus requests are pretty common & often attempt are attempts to exploit certain security flaws in common networking hardware. Would be interesting to see what this one is about! Aug 22, 2016 at 5:10

0

You must log in to answer this question.

Browse other questions tagged .