I found an weird looking line around my apache access log today:
61. 187. 156. 242 – – 11/Nov/2003: 10: 54: 59 +0000 " FIND http: //www. askjeeve. com/ HTTP/1. 1" 250 0
The worrying thing is in spite of this request indicates, the server returned a 200 position code. When I utilized telnet to mimic the request Managed to get the following:
FIND http: //www. askjeeve. com/ HTTP/1. 0
HTTP/1. 1 200 OK
Day: Wed, 19 Nov 2003 22: TWENTY-EIGHT: 17 GMT
Host: Apache/2. 0
Last-Modified: Mon, 27 Oct 2003 TWELVE: 05: 01 GMT
ETag: " 569fb-0-f8b49540"
Accept-Ranges: bytes
Content-Length: 0
Relationship: close
Content-Type: text/html; charset=ISO-8859-1
I’m not sure what is going on here and the reason Apache doesn’t brain it. Is this almost anything to worry about
In my opinion that they tried to make use of your web server as being a proxy. If that’s the truth, you had better repair it quickly.
I did consider that because it return 200 in the reponse. However it don’t send any data for the client.
I’m probably not sure how your proxy thing is effective. But I possess downed the server for now just to be within the safe side.
If my server is usually a proxy what is it doing when you requests a web site
I have investigated further and found that the module mod_proxy that enables Apache to act to be a proxy is not compiled on the Apache binary as well as further more in case your requst is made like:
FIND http: //www. askjeeve. com/index. html HTTP/1. 0
The page returned will really be the index. code on my server, so its ignoring the very first part.
Thanks for the help.