Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My access log is full of such entries: - - [03/Apr/2014:17:34:37 +0200] "GET HTTP/1.1" 403 168 "-" "Mozilla/5.0 (X11; U; Linux i686; en-GB; rv:1.7.6) Gecko/20050405 Epiphany/1.6.1 (Ubuntu) (Ubuntu package 1.0.2)" "-" - - [03/Apr/2014:17:34:37 +0200] "GET HTTP/1.1" 403 570 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; MathPlayer2.0)" "-" - - [03/Apr/2014:17:34:38 +0200] "GET HTTP/1.1" 403 168 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.452) Gecko/20041027 Mnenhy/" "-" - - [03/Apr/2014:17:34:38 +0200] "GET HTTP/1.1" 403 168 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv: Gecko/20071127 Firefox/ 3.0" "-" - - [03/Apr/2014:17:34:38 +0200] "GET HTTP/1.1" 403 168 "-" "Mozilla/5.0 (Windows; U; Win98; en-US; rv:0.9.2) Gecko/20010726 Netscape6/6.1" "-" - - [03/Apr/2014:17:34:38 +0200] "GET HTTP/1.1" 403 168 "-" "Mozilla/5.0 (Windows; U; Win9x; en; Stable) Gecko/20020911 Beonex/0.8.1-stable" "-"

So my server was attacked somehow as it seemes. What I don't understand is why there are these URLs. Does my server call those URLs? Those calls should be logged on that russian server, not on my one. Or am I wrong? Are these URLs just strings that are sent to my server when something on my server is called? But what is called?

I have no experience with the nginx server. So sorry if this question is dumb.

share|improve this question

The HTTP 1.1 protocol allows to specify a hostname with the request and this can be an arbitrary name belonging to a different (or none at all) host. This is what makes having multiple virtual hosts web servers possible because they can use the name specified in the request to route it to the correct vhost.

In the default config, hostnames that don't have a vhost definition get routed (and logged) to the default vhost.

What happens with your server is just the usual background noise of bots and kiddies trying all kind of attacks on more or less random hosts.

share|improve this answer
I think I get it. But it makes no sense to try this russian URLs on my server which is in Austria. It's easier to win a jackpot than trying to call something on some host. If I would attack a server at least I would try it with the right domain name... I don't get this. – Robert Schneider Apr 4 '14 at 7:15
Yes, it's a gamble, but unlike a lottery ticket, it doesn't cost the perpetrators anything to try a wide range of attacks on a wide range of hosts. – Sven Apr 4 '14 at 7:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.