Is this hacking?

GET http://www.100money.com/cgi-bin/ip.cgi

[WocitJC]

I've been seeing this all over my server logs - usually one or two a day. Not necessarily from 100money.com, but it's either ip.cgi or prx.php

I think it might be used as a gateway for Chinese users, since many of the ips that use it resolve back to Chinanet.

Any ideas, oh wise ones?

[MattyMoose]

They are trying to see if your webserver is running a proxy (GET'ing an outside URL is the clue).

They are going to that address, which shows me:

ProxyJudge V2.35

REMOTE_HOST=1.1.1.1
REMOTE_ADDR=1.1.1.1

HTTP_ACCEPT_LANGUAGE=en-ca,en;q=0.7,en-us;q=0.3
HTTP_USER_AGENT=Mozilla/5.0 (X11; U; FreeBSD i386; en-US; rv:1.7.12) Gecko/20051117 Firefox/1.0.7

* REMOTE_HOST

Result
IP Addr.
Comment
I have no idea because DNS lookup failure.

* HTTP Env. Value

Result
Anonymized
Comment
No "Connection=Keep-Alive" is dubious

* AnonyLevel : 2
Nice. It it useful.

I'm assuming it thinks my direct connection is "nice" because of my Squid Proxy server in between me and the interweb.

Most likely it's an automated scan that's seeing if your server will go out and fetch that URL, which in turn tests the anonymity of your proxy (if you were running one).

I see it fairly regularly, and it's nothing to be concerned about, unless you have actually enable the Apache Proxy service, or some other type of proxy.

[WocitJC]

thanks MattyMoose - we don't have a proxy, so I guess I'll cross it off the list of things to worry about!