Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.
Sign up to join this community
I was looking through my Nginx (port 80) access log on a server which I do not use much, and I found a lot of lines that have an entire URL in the get statement. What is that supposed to accomplish? Most return a 404, but one of them (not the one below) was a 200, and had several Hexadecimal codes in the request right after it. What is going on?
#.#.#.# - - [28/Sep/2016:18:01:31 +0000] "GET http://www.baidu.com/cache/global/img/gs.gif HTTP/1.1" 404 169 "-" "Mozilla"
Maybe you're using one of the ips of Chinese baidu service? To be honest: if you're running server on public IP you'll have to get used to such entries. Treat them as stats and react if strange entries exceed some threshold.
You are scanned by somebody for open proxy...
