Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In my ACCESS_LOG, I'm see alot of strange things, requests from other IPs trying to connect to other IPs.

An example line:

67.212.81.217 - - [15/Dec/2009:17:38:26 +0000] "GET http://www.megaupload.com/?d=JE615TVO HTTP/1.1" 200 531 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"

Has my Apache been hacked? How can I disable it?

I tried to google about such a problem, some sites suggests it about the mod_proxy, I tried disabling it, but problem still persists.

share|improve this question

3 Answers 3

If it's not DNS the other thing is just people trawling for open proxies they can use to get anonymity.

share|improve this answer

LapTop006 is correct. I would suggest trying to reproduce the problem:

$ telnet yoursite.net 80 
Trying 1.1.1.1...
Connected to yoursite.net.
Escape character is '^]'.

Then enter:

GET http://www.megaupload.com/?d=JE615TVO HTTP/1.1
Host: yoursite.net

Hit enter again and see what content comes back. I think you'll see a 200 OK followed by whatever content requests for /?d=JE615TVO on your site gives.

There is an explanation of this behavior at http://httpd.apache.org/docs/1.3/misc/FAQ.html#proxyscan.

share|improve this answer

The IP you mentioned look alright. There is nothing special in that piece of log, and nobody is connecting nowhere, somebody is trying to download a file from you server. If you server is not the domain you can see after the http:// it means there is a nameserver malfunctioning.

To check the requester IP:

whois 67.212.81.217
host 67.212.81.217
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.