25

I am running a Centos7 web server. I noticed a few strange HTTP GET requests like these:

94.185.83.100 - - [29/Feb/2016:23:29:00 +0530] "GET http://testp1.piwo.pila.pl/testproxy.php HTTP/1.1" 404 390 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/31.0"
185.25.151.159 - - [01/Mar/2016:07:36:40 +0530] "GET http://testp1.piwo.pila.pl/testproxy.php HTTP/1.1" 404 390 "-" "Mozilla/5.0 (Windows NT 5.1; rv:32.0) Gecko/20100101 Firefox/31.0"
  1. I have no connection to the domain piwo.pila.pl. How did it end up in my Apache access_log?
  2. In the error_log document, the same document is given under my web root, i.e.: [Mon Feb 29 23:29:00.175813 2016] [:error] [pid 11382] [client 94.185.83.100:43718] script 'myWebRoot/testproxy.php' not found or unable to stat Is this expected behavior? That the access_log keeps a record of the exact request while the error_log tracks the same request but translated to a URL on the file system?
Anko
  • 189
  • 10
Sriram
  • 373
  • 3
  • 6
  • 1
    I asked a very similar question [here](http://security.stackexchange.com/questions/84720/external-websites-in-logs). The answer really helped me to understand why this happens and how it works. – Zachary Dow Mar 04 '16 at 16:14
  • @ZacharyDow: Thank you for that link. That was helpful. – Sriram Mar 07 '16 at 09:54

1 Answers1

34

Your website has been hit by an automated script that looks for open proxies on the internet. The url it's trying to access would record a successful proxied request and add your server to a list.

wireghoul
  • 5,745
  • 2
  • 17
  • 26
  • thank you for your reply. but how does a request to piwo.pila end up on my server? How and where has that "mapping" been done? Also, is the error_log path correct, I mean is that how it is supposed to look? – Sriram Mar 04 '16 at 11:47
  • 41
    Anyone can connect to a web server and request any host at all. It's like asking why someone calls your phone number and asks for the wrong person. – Jenny D Mar 04 '16 at 11:52
  • @wireghoul: thanks. Your answer and the other links helped out quite a bit. – Sriram Mar 07 '16 at 09:55