Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got several log entries that refer to an external domain - mainly a Russian search engine (

How are these appearing in my logs? - - [10/Jun/2010:00:49:11 +0000] "GET HTTP/1.0" 200 8859 "" "Opera/9.80 (Windows NT 5.1; U; ru) Presto/2.5.22 Version/10.50"` - - [10/Jun/2010:01:54:10 +0000] "GET HTTP/1.0" 200 8859 "" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv: Gecko/20100316 Firefox/3.6.2"` - - [10/Jun/2010:02:55:34 +0000] "GET HTTP/1.0" 200 8859 "" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/ Safari/532.5" - - [09/Jun/2010:11:04:17 +0000] "GET HTTP/1.1" 404 1010 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
share|improve this question
up vote 7 down vote accepted

The probes are by crackers looking for open proxies: some (badly configured) reverse proxies will connect to any domain, not just the domain they're supposed to be serving. They are trying to use your server to connect to and abuse another site.

share|improve this answer
So the entries being in the logs isn't a cause for concern - unless I'm acting as a proxy. – Johan Jun 10 '10 at 14:35
That's right. The chances of you being a public proxy without realising are quite slim, especially if you're serving your website directly from your server without any proxying at all. – Andrew Aylett Jun 11 '10 at 10:20

Anyone can connect to a webserver and request any url they wish from any host. It'll then turn up in your log. An example,

$ nc 80
GET / HTTP/1.1

Will get you an entry in your apache log for

share|improve this answer
I didn't know that. I've just tried your example, and I get 82.69.x.x - - [10/Jun/2010:09:45:24 +0000] "GET / HTTP/1.1" 400 350 "-" "-" No mention of asdfxxxetc But if that's the how - what's the why? – Johan Jun 10 '10 at 9:59
Probably seeing if they can redirect a request from your site to hide their tracks, I'd guess. See if you can act as a proxy, or probing for an exploit. – Bart Silverstrim Jun 10 '10 at 12:13
You need to issue "GET HTTP/1.1" as the request to initiate proxying, try that and you'll (probably) see it in the log. – Vatine Jun 10 '10 at 12:30

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.