Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My apache2 log is bombarded with lines like: - - [03/Aug/2012:15:23:28 +0200] "GET HTTP/1.0" 404 1690 "" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"

I am puzzled by this -- why is a request for some weird domain ending up on my server in the first place?!

The request comes every few dozens of seconds, must be a robot. Any ideas what it is?

Btw that URL is valid -- apparently it contains some test page...

share|improve this question
Is it always from the same ip address? – Mike Pennington Aug 3 '12 at 14:01
@Mike: not at all, many different IPs – user1571418 Aug 3 '12 at 14:06
"why is a request for some weird domain ending up on my server in the first place?!" There isn't necessarily a reason. If your IP address is publicly available on the Internet, it will receive all manner of strange traffic. There is really nothing to stop me from pointing "" to your IP address, but you can configure your webserver to return an error for anything that you do not explicitly allow. This is the nature of the internet. – Stefan Lasiewski Dec 7 '12 at 23:15

Somebody is checking if your server is a open proxy by requesting:

It doesn't look like you are running an open proxy since it responded with a 404.
For more information on this see:
Especially the "But how can I be really sure that I am not allowing the abuse of other sites" part.

We can't tell why it continues to try it even after it should be clear that you don't run a proxy.
Maybe that guys script is broken.

share|improve this answer
Where is it checking, under which URL? I don't understand why this request for domain comes to my server at all. – user1571418 Aug 3 '12 at 14:00
No URL, tried to request via your server (and failed). It comes to your server because sends it. Check the link I added to my answer. – faker Aug 3 '12 at 14:18

i too keep getting hit from this bot

i've just added this in my .htaccess

RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} xchecker\.net [NC]
RewriteRule .* - [F]

then in my error logs

[error] [client] client denied by server configuration: /var/www/html/proxy2012/http/engine7.php, referer:

so far so good.

Plus if the attacks are coming in super fast, you might want to think of using mod_evasive

I've sent a email to the but they have not responded.

share|improve this answer
Two notes: One, that rewrite can also go in vhost configuration, which is (or at least was) somewhat more efficient than .htaccess files. Two, with a non-core module like mod_evasive it would be considered cool to link the module page. – pjmorse Sep 29 '12 at 1:04 has the same IP as So, both of them are pointing to the same server. Do you know you are running a proxy?

If not, I would suggest you shut it down, and rebuild your server.

Check the source, for the request above, it was If they keep bugging you, block them with iptables. If there are a lot of different IP's, you are being hit from a bonnet. Not much you can do but take the pages offline.

The page exists for me:

enter image description here

The reverse DNS also doesn't add up:

[bart@dev ~]$ dig

; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6_2.3 <<>>
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15494
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;          IN  A

;; ANSWER SECTION:       108 IN  A

;; Query time: 11 msec
;; WHEN: Fri Aug  3 18:14:36 2012
;; MSG SIZE  rcvd: 46

[bart@dev ~]$ dig -x

; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6_2.3 <<>> -x
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 515
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;    IN  PTR


;; Query time: 59 msec
;; WHEN: Fri Aug  3 18:14:44 2012
;; MSG SIZE  rcvd: 79

If your server is not, then someone has your domainname & '' in their hostfile so it would resolve to you. If you see a lot of different IP's it's probably a change that was pushed to a lot of infected computers.

My guess would be that the IP of your server was used for some bad purposes in the past.

If you wan't to stop the 404's, you can put this on top of your vhost configuration:

<VirtualHost _default_:*>
  RedirectMatch permanent ^/?(.*)

This will redirect every unknown vhost to your main site.

share|improve this answer
There is no page (404), so nothing to take offline. Also, if I'm not running a proxy, how can I shut it down? – user1571418 Aug 3 '12 at 14:08
I don't know about you, but the site definitely exists for me, I'll update with some more information about name records. – Bart De Vos Aug 3 '12 at 14:12
Aha, so a forced DNS resolution on infected machines, that's why I receive the requests. And my Apache responds to them, even though no such vhost is configured? Is it possible to switch off this Apache behaviour (ignore requests for unknown domains)? – user1571418 Aug 3 '12 at 17:54
Btw thanks for the investigation Bart, I will upvote once I have enough karma. – user1571418 Aug 3 '12 at 17:54
@user1571418: No problem, updated above. – Bart De Vos Aug 3 '12 at 17:56

I've run into this problem plenty of times -- getting hit from thousands of unique IPs. They didn't seem to care that my server refused to proxy. They just kept hitting it. My solution was to write a short app that tailed the access log and looked for hits matching the pattern. ie Requests for content on other domains. As they were parsed, I added them to the iptables drop list.

Server resource load dropped DRAMATICALLY!

share|improve this answer
Have you ever heard of fail2ban? – Michael Hampton Aug 1 '13 at 18:50

I also see many of these request in my logs, searching for server's IP address and proxy in google I came to this list:

It seems to be a tool with a list of all our servers to be used as a proxy.

I found 3 of my server's IP addresses and do not longer wonder why I got so many requests, even if they got only errors.

I added an empty web for the IP addresses, since my customers use the names only, that should help to get out of the list soon, I hope.

share|improve this answer
And did you disable proxying, too? – sendmoreinfo Aug 22 '13 at 19:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.