Help:About the Apache log files problems

[thrack]

Hi,everyone:

My system is Windows 2000 server,and I have created My website with Apache+Php+Mysql in it.My IP is an Internet static and valid IP address.Theses days I found some strange problems in the Apache log file(access.log),these logs below appeared in the ACCESS.LOG somtime(The xxx.xxx.xxx.xxx is the IP address):
xxx.xxx.xxx.xxx - - [06/Sep/2001:14:59:35 +0800] "GET http://www.s3.com HTTP/1.1" 200 13878
xxx.xxx.xxx.xxx - - [06/Sep/2001:21:42:07 +0800] "GET http://www.ebay.com/ HTTP/1.1" 200 14640
xxx.xxx.xxx.xxx - - [06/Sep/2001:21:42:07 +0800] "GET http://www.netease.com/ HTTP/1.1" 200 14640
But in fact,My site has nothing with the sites www.s3.com,www.ebay.com,www.netease.com.

Who knows the answer?


Thanks.

[Anon]

That's people leaving your site

[Anon]

Just that?

[Anon]

Is that true? Have the same entries in my logs (and funny enough: it is only ebay) and tested leaving my own website myself. Checked the logfile afterwards and there was NADA. Still wondering about this.

Further, the log shows a response '200', meaning something correct was returned. Then if you look in the reported bugs on the apache.org site, you see people complaining that they cannot reach e-bay and all they get is the 'Apache successfully installed' screen...

[grynlar]

This isn't somebody going to ebay from your site. I have been having the same problem and I started looking into it. from the notes I have read it is someone looking for a proxy that will forward .. which is fine I don't have proxies on any of my servers. YET I question why the hell does it have a 200 which means that apache accepted the url as ok. I really would like an answer to this.

[grynlar]

I just found something that seems to answer this question .. it is a post on apachelabs.org and I am putting it here because I think it has relevant info to this problem

> What I don't understand:
>
> http://www.ebay.com/
>
> My server is www.yoursite.com. How can a request for another site be
> made on mine? What does it mean when I see something of this nature?

Somebody is trying to use your server as a proxy server. Check your
httpd.conf to make sure that the proxy is turned off. Most likely, they are
not being sucessful. To check for sure, you can do the following:

telnet www.yoursite.com 80
GET http://www.ebay.com/ HTTP/1.1
Host: www.ebay.com

and press "enter" twice at the end.

If you get your own homepage back, then everything is configured correctly
and apache is ignoring the attempt to use your server as a proxy. If you
get ebay's home page, then you are running an open proxy, which could be
dangerous.

Joshua.

Thanks Joshua

[Anon]

You get a 200 response as your webserver sends out your default page in some cases.