Strange GET requests: http://<insert popular site here>

Are these hacker robots trying to find proxies?

[jtara]

I have a pretty much bare out-of-the-box Apache 2.0.54 installed on a test machine at home. (No content - just the Apache test page.) I've exposed it to the Internet through port forwarding on my firewall. Because I'm on a cable connection that blocks inbound traffic to port 80, I put it on port 8000. (On the firewall - internally it's on port 80.)

I noticed in the log that I've been getting a small number of hits. It's a fair bet that these are up to no good.

Those that aren't my own accesses seem to be coming mostly from overseas - Korea seems a popular source.

What struck me as strange is the form that the GETs take. They consist of full paths (including http:) to other web sites, which tend to be popular ones.

Examples:

219.135.164.30 - - [20/Dec/2005:18:52:30 -0800] "GET [abcseek.info...] HTTP/1.1" 40
4 341 "-" ""
219.135.164.30 - - [20/Dec/2005:19:22:50 -0800] "GET [abcseek.info...] HTTP/1.1" 40
4 341 "-" ""
211.59.25.199 - - [20/Dec/2005:21:59:52 -0800] "GET [intel.com...] HTTP/1.1" 403 3931 "-" "Mozilla
/4.0 (compatible; MSIE 4.01; Windows 98)"
203.228.37.221 - - [21/Dec/2005:04:26:06 -0800] "GET [intel.com...] HTTP/1.1" 403 3931 "-" "Mozill
a/4.0 (compatible; MSIE 4.01; Windows 98)"

Am I correct in assuming that these are some kind of hacker robots probing for proxy servers? Or is my Apache server, in fact, acting as a proxy server when given these mal-formed paths? (By design or by error?)

I notice that the server returned 404 for the first two in the examples above, and 403 for the second two.

Hopefully, this is obvious to most here and I'll get a quick reply. I'm a bit rusty, as I haven't operated a website in years (last Apache version I used as 1.4) and so I'm in the process of getting back up to speed both in terms of server functionality and features as well as what exploit attempts I might face.

I'm turning off the port forwarding for now, as I really had no reason to have it on, other than to test that I know how to set it up. I'll be running a site at a hosting company, but it's useful to be able expose a test machine when working with others on a site, etc.

Anyone know what these are, and what potential danger they might pose? I think I can turn them off pretty easily with a URL pattern in my firewall. (Netscreen).

[py9jmas]

Are these hacker robots trying to find proxies?

Yes

I notice that the server returned 404 for the first two in the examples above, and 403 for the second two.

When not configured as a proxy, Apache will serve pages from the default virtual host for hosts it doesn't recognise. In other words, the requests for http://www.example.com/ will return your default 'Apache is working' homepage. Requests for http://www.example.com/cgi/whatever.cgi will serve /cgi/whatever.cgi from your default vhost. Since that file doesn't exist, it gets a 404.
I'm not entirely sure why they are getting 403s though, unless there are some allow from/deny from configurations restricting access.

[jtara]

I guess I should have asked this in "logging & tracking" - didn't realize that forum fielded these kinds of questions.

But thanks, answered my question!

I do have the ability to block URLs based on a match in my firewall, so I have blocked anything starting with "http://".

And I guess I could pick a less obvious port than 8000. Could be worse, I could have picked 8080.