4

In my access logs i have some requests like so:

[18/Dec/2014:10:07:51 +0300] "GET /favicon.ico HTTP/1.1" 301 184 "-" "Mozilla/5.0 (Windows NT 6.1; rv:6.0) Gecko/20110814 Firefox/6.0 Google favicon"

[18/Dec/2014:11:35:11 +0300] "GET http://s1.bdstatic.com/r/www/cache/static/home/img/logos/nuomi_ade5465d.png HTTP/1.1" 301 184 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.3072; .NET CLR 2.0.50727; .NET CLR 3.0.30729; Tablet PC 2.0)"

what's this? Should I be concerned about security?

  • I guess, somewhere on your site you have image/link without protocol part. I.e. <img src="/s1.bdstatic.com/r/..."> instead of <img src="http://s1.bdstatic.com/r/..."> – Alexey Ten Dec 18 '14 at 14:21
  • 2
    Well, It's dump prefetcher, or some robot downloader. I've seen a lot of such requests (but mostly from old Opera). Just ignore it. – Alexey Ten Dec 18 '14 at 14:28
4

There is no reason for concern in the log entries you posted.

The first is a request for an image file that many browsers use as icon when displaying a page from your site or a bookmark.

The second request is an attempt to use your server as HTTP proxy. However it looks like your server just ignores the proxy part of that attempt and instead responds as if it had been a local site.

If you want to be certain, you can test it manually using telnet. Here is what it looks like on one of my servers:

$ telnet localhost 80
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
GET http://s1.bdstatic.com/r/www/cache/static/home/img/logos/nuomi_ade5465d.png HTTP/1.1
Host: s1.bdstatic.com

HTTP/1.1 404 Not Found

And here is what it looks like if I try to access the root of the domain:

$ telnet localhost 80
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
GET http://s1.bdstatic.com/ HTTP/1.1
Host: s1.bdstatic.com

HTTP/1.0 302 Moved Permanently

Both of the above were served by my default vhost.

In your case I would assume you have a default vhost configured to redirect everything to your actual domain.

5

Point of information -- we saw a few requests for this exact same URI (s1.bdstatic.com) come through one of our addresses a few days ago. So i'm reluctant to assume the request is benign, although it could just be someone using that image in a scan for open proxies.

125.64.35.67 1418849297 <internal> GET http://s1.bdstatic.com/r/www/cache/static/home/img/logos/nuomi_ade5465d.png HTTP/1.1
125.64.35.68 1418853519 <internal> GET http://s1.bdstatic.com/r/www/cache/static/home/img/logos/nuomi_ade5465d.png HTTP/1.1
  • 3
    Same request on our servers. I think it is definitely somebody scanning for open proxies. That's generally the reason when receiving requests containing a http://... – Ale Dec 19 '14 at 19:03
  • 2
    It certainly looks like a scan for open proxies. If your server isn't an open proxy, there is no need to worry. – kasperd Dec 19 '14 at 19:19
1

It's a scan for open proxies. I've seen a few in the last couple of weeks.

125.64.35.68 - - [05/Jan/2015:03:54:36 -0500] "GET http://s1.bdstatic.com/r/www/cache/static/home/img/logos/nuomi_ade5465d.png HTTP/1.1" 403 254 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.3072; .NET CLR 2.0.50727; .NET CLR 3.0.30729; Tablet PC 2.0)"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.