Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a massive ammount of strange requests im my Apaches's access_log.

Some examples of the requested URIs:

216.110.10.170 - - [22/May/2013:18:44:05 +0200] "GET /?url=https://mail.google.com/mail/?shva=1 HTTP/1.1" 401 1248
173.252.71.189 - - [22/May/2013:18:44:07 +0200] "GET /?url=http://www.amazon.com/gp/product/handle-buy-box/ref=dp_start-bbf_1_glance HTTP/1.1" 401 1248
69.63.185.56 - - [22/May/2013:18:43:09 +0200] "GET /?url=https://www.facebook.com/messages/susan.coop HTTP/1.1" 401 1248

It's interesting that all those IP adresses are registered to Facebook.

All requests result in a 401 because the server's DocumentRoot is protected by a .htaccess file.

So does anybody know, why these requests are made?

share|improve this question

2 Answers 2

up vote 1 down vote accepted

They are scanning for an open proxy. There are two reasons to do this.

First, and most often, someone is looking for an open proxy to abuse. This or some other type of automatic scanning is the most frequent reason for suspicious log entries. The first IP has a referral whois that appears to point at facebook, but you'll note the address is different, and it seems somewhat odd (there isn't even an admin contact, and the address differs). This might, or might not, be someone else.

Second, sometimes people looking for security intelligence will run these types of scans to make blacklists of servers open to abuse. This data can then be used as input to a heuristic (whether to show a CAPTCHA, perhaps, or whether an action is suspicious, can be enhanced by knowing whether the request came from an open proxy). Facebook may or may not be collecting such data.

Of course, it's also possible a bunch of PCs (or even servers) at facebook were compromised or running a botnet or visited a malicious link, and that may be the reason for the traffic.

The impact of such traffic toward something other than an open proxy is basically nil, and it is best ignored.

share|improve this answer

It's a test to see whether your server can be abused as an open proxy.

Also, the first IP address belongs to twtelecom.net, not to facebook. The other two are in netblocks belonging to facebook.

share|improve this answer
    
Why would Facebook do that? –  Flup May 23 '13 at 9:01
    
I would suggest that you ask Facebook. The correct address would be abuse@facebook.com. But my guess is that it's a facebook user tricking other users into clicking on something that makes this request, rather than faceboook the company itself. –  Jenny D May 23 '13 at 9:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.