I have a slice with a hosting provider that has a basic lamp stack setup. I was checking my apache logs today and I'm getting total random (it seems) request to my apache server. For instance, here are two entries:
184.108.40.206 - - [20/Jul/2011:07:28:27 +0000] "GET http://www.czhlk.com/sony/cheng2/error.asp HTTP/1.1" 200 11322 "http://www.baidu.com" "Mozilla/4.0" 220.127.116.11 - - [20/Jul/2011:07:28:29 +0000] "GET http://18.104.22.168:8083/Payrank.php HTTP/1.1" 200 11315 "http://22.214.171.124:8083/Payrank.php" "Mozilla/4.0"
Right now I only have some test php scripts up so I wasn't expecting a lot of traffic but I'm getting several requests a second with entries similar to the one's just posted. The strange thing is that if you look at the url requested in the access log, they are not referencing resources on my machine. I've installed chkrootkit and couldn't find anything. I've also checked the password file and other areas to see if somebody might have hacked me. So far I haven't found anything but I'm not a system admin or anything, just a software developer. Also, all of the http codes in the log are '200' which is strange to me. So how is it that my apache is returning 200 for http requests that aren't requesting anything on my server? I would expect something like this:
126.96.36.199 - - [20/Jul/2011:07:35:03 +0000] "GET /index.php" ....
Not a fully qualified url for completely different sites. What am I missing, sorry if it's a stupid question.
Here is the contents of my mods-available/proxy.conf file, I don't see anything wrong with it so far:
#turning ProxyRequests on and allowing proxying from all may allow #spammers to use your proxy to send email.
ProxyRequests Off <Proxy *> AddDefaultCharset off Order deny,allow Deny from all #Allow from .example.com </Proxy> # Enable/disable the handling of HTTP/1.1 "Via:" headers. # ("Full" adds the server version; "Block" removes all outgoing Via: headers) # Set to one of: Off | On | Full | Block ProxyVia On