apache logs

bandejapaisa · 02-16-2009, 04:40 PM

Hi,

Looking through my apache logs i'm getting shed loads of requests GET
and POST to random domains that are not on my server... whats this all
about:

eg:

Code:

89.169.36.221 - - [16/Feb/2009:22:17:38 +0000] "GET http://koctya.ru/proxima.php HTTP/1.1" 401 1219 "-" "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; ru)"

89.169.36.221 - - [16/Feb/2009:22:17:39 +0000] "GET http://zhurnal.lib.ru./b/beleckaja_e_w/ HTTP/1.1" 401 1219 "-" "Opera/ 9.10 (X11; FreeBSD 6 i386; U; ru)"

213.231.15.57 - - [16/Feb/2009:22:18:03 +0000] "GET http://counter.rambler.ru:80/top100.cnt?1594512 HTTP/1.1" 401 1219 "http://russia.ddating.ru" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.1.5) Gecko/20070713 Firefox/2.0.0.5"

89.169.36.221 - - [16/Feb/2009:22:18:16 +0000] "GET http://koctya.r /proxima.php HTTP/1.1" 401 1219 "-" "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; ru)"

89.169.36.221 - - [16/Feb/2009:22:18:17 +0000] "GET http://zhurnal.lib.ru./b/beleckaja_e_w/ HTTP/1.1" 401 1219 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1;  Embedded Web Browser from: http://bsalsa.com/)"

Why am i get these in my logs?

Thanks

acid_kewpie · 02-18-2009, 01:30 AM

People trying to use you as a proxy. You can't do anything about this really - it's clearly NOT working for them, so not much to worry about. If you want you could maybe ban the source IP with fail2ban or similar tool.