Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm getting the following GET requests in my apache logs:

109.230.251.14 - - [29/Mar/2011:16:28:18 +0100] "GET http://209.191.92.114/config/pwtoken_get?login=jackmcphee232&src=ygodgw&passwd=e59e2240415e6f1aba3da72b8f189f4e&challenge=9TbU_9yfZhKmzlHtK9X4OkQlesTH&md5=1 HTTP/1.0" 404 1226 "-" "-"

Any idea what it could be and how is that possibly a get request? That IP address seems to point to Yahoo! I'm very confused.

share|improve this question
    
You can get such request via proxy server. –  Khaled Mar 29 '11 at 15:48

2 Answers 2

I had the same issue. After a long search I found this wiki article that explains what's going on pretty well.

http://wiki.apache.org/httpd/ProxyAbuse

share|improve this answer

Sadly, it's just one of the many automated vulnerability tests constantly peppering web servers these days.

share|improve this answer
    
How do they get the 'GET' to show another domain though? –  alfred Mar 29 '11 at 16:00
    
Proxying I'd guess. You can mangle URLs in all kinds of ways. –  Jonathan Ross Mar 29 '11 at 16:06
    
The GET-request contains the domain name. Therefore, You can connect to any web server and ask for any domain. By using this mechanism, one server with one IP can host several domains (aka Virtual Host). I guess someone or something tried to check, if You server is configured to actually forward the request (which would be a severe security issue). –  Black Apr 2 '12 at 11:25

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.