2

I was looking through my Nginx (port 80) access log on a server which I do not use much, and I found a lot of lines that have an entire URL in the get statement. What is that supposed to accomplish? Most return a 404, but one of them (not the one below) was a 200, and had several Hexadecimal codes in the request right after it. What is going on?

#.#.#.# - - [28/Sep/2016:18:01:31 +0000] "GET http://www.baidu.com/cache/global/img/gs.gif HTTP/1.1" 404 169 "-" "Mozilla"

2 Answers 2

1

Maybe you're using one of the ips of Chinese baidu service? To be honest: if you're running server on public IP you'll have to get used to such entries. Treat them as stats and react if strange entries exceed some threshold.

0

You are scanned by somebody for open proxy...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.