Welcome to WebmasterWorld Guest from 34.204.191.31

Forum Moderators: Ocean10000 & phranque

Message Too Old, No Replies

Unrelated website requested in raw server logs

Why would someone else's site show up in my logs?

     
10:22 pm on Aug 1, 2016 (gmt 0)

New User

5+ Year Member

joined:Jan 19, 2012
posts: 25
votes: 0


I am new to raw server logs...can anyone suggest why I might see the following entry in my raw server logs? Let's say my site is example.com and random-website.com is completely unrelated to my site - it's in Spanish but it looks like some kind of website optimisation/web design site which is nothing to do with me.

54.232.454.141 - - [01/Aug/2016:12:52:03 -0500] "GET /http:/random-website.com/page-on-random-website.htm HTTP/1.1" 404 1195 "-" "Go-http-client/1.1 X-Middleton/1"

It's returning a 404 page not found. which is correct of course as it's not even my domain name.

If it is something dodgy, should I block the IP? Thanks for your help.
11:47 pm on Aug 1, 2016 (gmt 0)

Full Member

Top Contributors Of The Month

joined:Apr 11, 2015
posts: 328
votes: 24


Presumably the IP address "54.232.454.141" is not the actual IP address you are seeing in your logs?!

This is the result of a request for a URL of the form (example.com being your site):


http://example.com/http:/random-website.com/page-on-random-website.htm


Possibly with two slashes after the "http:" part, which Apache has collapsed. (?)

This request would seem to be wholly invalid. My guess is either a badly coded bot or a roundabout attempt at referer-type spam?! Whether you block the IP or user-agent is your call. Are you getting a lot of requests from this IP/UA? Is it causing a problem?

More information about this UA in this WebmasterWorld thread:
[webmasterworld.com...]
11:57 pm on Aug 1, 2016 (gmt 0)

Senior Member from US 

WebmasterWorld Senior Member keyplyr is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Sept 26, 2001
posts:12913
votes: 893


If it is something dodgy, should I block the IP?
As whitespace noticed, this is not a valid IP. Probably a typo on your part. However, the /16 belongs to Amazon Web Services:
54.232.0.0 - 54.232.255.255
54.232.0.0/16

Many webmasters categorically block this and other AWS ranges, then poke holes for beneficial bots from those ranges.

However, this UA (Go-http-client/1.1) is likely not an agent you would wish to allow from *any* range.