Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In my ACCESS_LOG, I'm see alot of strange things, requests from other IPs trying to connect to other IPs.

An example line: - - [15/Dec/2009:17:38:26 +0000] "GET HTTP/1.1" 200 531 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"

Has my Apache been hacked? How can I disable it?

I tried to google about such a problem, some sites suggests it about the mod_proxy, I tried disabling it, but problem still persists.

share|improve this question

If it's not DNS the other thing is just people trawling for open proxies they can use to get anonymity.

share|improve this answer

LapTop006 is correct. I would suggest trying to reproduce the problem:

$ telnet 80 
Connected to
Escape character is '^]'.

Then enter:


Hit enter again and see what content comes back. I think you'll see a 200 OK followed by whatever content requests for /?d=JE615TVO on your site gives.

There is an explanation of this behavior at

share|improve this answer

The IP you mentioned look alright. There is nothing special in that piece of log, and nobody is connecting nowhere, somebody is trying to download a file from you server. If you server is not the domain you can see after the http:// it means there is a nameserver malfunctioning.

To check the requester IP:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.