Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

While studying for the RHSCA exam I set up my first home server and quickly found that bots had already started requesting commonly vulnerable files. It was alarming at first, then just purely amusing once I found out how harmless and ineffective these particular attempts were.

Now I am seeing some odd requests in my apache access_log that I just don't understand and was hoping someone could help clarify for me.

I don't understand why the bot would request another server from within my server's path. It's my understanding that the bot is requesting the following resource in the log shown below: http://MY.IP.ADD.RESS/ - - [15/Sep/2012:06:47:38 -0500] "GET HTTP/1.1" 404 287 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

That just doesn't even make any sense. I am getting quite a few of these nonsensical requests and I was wondering if requesting another server from someone else's server might in someway prove useful for an intruder or if this is just a script kiddie that has no idea what they're doing.

Some more examples of this in my access log. - - [14/Sep/2012:05:28:48 -0500] "GET HTTP/1.1" 404 289 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" - - [14/Sep/2012:08:26:55 -0500] "GET HTTP/1.0" 404 289 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" - - [14/Sep/2012:08:26:57 -0500] "GET http://www.yahoo.com/ HTTP/1.0" 200 101 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" - - [14/Sep/2012:13:11:58 -0500] "GET HTTP/1.0" 404 289 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" - - [14/Sep/2012:13:11:59 -0500] "GET http://www.yahoo.com/ HTTP/1.0" 200 101 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)" - - [14/Sep/2012:15:34:53 -0500] "GET HTTP/1.1" 404 299 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"

I am thinking that maybe these bots are requesting these files to encourage host administrators to actually visit these addresses due to their curiosity with the goal of gathering data, or something. I am thinking this mainly because I visited one and it did a whois lookup on me and displayed that information on the page. I only tried one so I don't know if that is a common pattern.

In short, why are these bots requesting other websites from the file structure of my website? I'm using CentOS.

share|improve this question
up vote 6 down vote accepted

Those requests are exactly what a web browser sends to a web proxy, so the remote clients are likely probing for open web proxies.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.