Re: [TriLUG] weird http connections

[Steve Kuekes]

It looks like to me that you have an open proxy server on your apache 
configuration and these guys are using it to access other web sites to 
camoflauge their addresses.  Check your apache config for mod_proxy.  If 
you're using proxy on apache don't let it proxy requests from outside 
the internet or just turn it off.

Michael Hrivnak wrote:

I've noticed that I'm getting weird requests logged by apache.  The following 
are the most recent requests found on apache's server status page.  Why are 
all of these hitting my machine?  I've got a RR connection for what it's 
worth, and the machine in question is connected directly to the cable modem.  
I'm getting IP addresses from all over the place (China, Germany, 
Netherlands, etc.) making lots of requests for pages that have nothing to do 
with my domain.  Is this normal?

Mandrake 9.2, fully updated, apache 2, etc.

Let me know if I can provide more info.

Thanks,
Michael
0-0	11173	0/32/7402	_ 	0.09	1	0	0.0	0.09	37.75 	24.74.25.228	hrivnak.org	GET 
http://edit.in.yahoo.com/config?login?.tries=1&.src=bl&logi
1-0	11301	0/6/7270	W 	0.05	10	0	0.0	0.01	40.38 	24.74.25.228	hrivnak.org	GET 
http://edit.tpe.yahoo.com/config?login?.tries=1&.src=bl&log
2-0	11286	0/10/6777	W 	0.08	12	0	0.0	0.15	35.86 	68.34.251.56	hrivnak.org	GET 
>>> Snipped
--
Steve Kuekes
--
TriLUG mailing list        : http://www.trilug.org/mailman/listinfo/trilug
TriLUG Organizational FAQ  : http://trilug.org/faq/
TriLUG Member Services FAQ : http://members.trilug.org/services_faq/
TriLUG PGP Keyring         : http://trilug.org/~chrish/trilug.asc