1

In my ACCESS_LOG, I'm see alot of strange things, requests from other IPs trying to connect to other IPs.

An example line:

67.212.81.217 - - [15/Dec/2009:17:38:26 +0000] "GET http://www.megaupload.com/?d=JE615TVO HTTP/1.1" 200 531 "-" "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)"

Has my Apache been hacked? How can I disable it?

I tried to google about such a problem, some sites suggests it about the mod_proxy, I tried disabling it, but problem still persists.

Improve this question

3 Answers 3

Reset to default
2

If it's not DNS the other thing is just people trawling for open proxies they can use to get anonymity.

Improve this answer
1

LapTop006 is correct. I would suggest trying to reproduce the problem:

$ telnet yoursite.net 80 
Trying 1.1.1.1...
Connected to yoursite.net.
Escape character is '^]'.

Then enter:

GET http://www.megaupload.com/?d=JE615TVO HTTP/1.1
Host: yoursite.net

Hit enter again and see what content comes back. I think you'll see a 200 OK followed by whatever content requests for /?d=JE615TVO on your site gives.

There is an explanation of this behavior at http://httpd.apache.org/docs/1.3/misc/FAQ.html#proxyscan.

Improve this answer
-2

The IP you mentioned look alright. There is nothing special in that piece of log, and nobody is connecting nowhere, somebody is trying to download a file from you server. If you server is not the domain you can see after the http:// it means there is a nameserver malfunctioning.

To check the requester IP:

whois 67.212.81.217
host 67.212.81.217
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .