My server recently started getting a massive increase in the number of random URL requests.
124.173.67.77 - - [23/Jul/2016:21:21:04 -0400] "GET HTTP/1.1" 200 12040 "" ""195.182.131.107 - - [23/Jul/2016:21:21:04 -0400] "GET HTTP/1.1" 404 474 "-" "Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.9.0.1) Gecko/2008070208"155.94.224.168 - - [23/Jul/2016:21:21:04 -0400] "GET HTTP/1.1" 404 470 "" "Mozilla/5.0 (compatible; Googlebot/2.1; )"119.29.32.85 - - [23/Jul/2016:21:21:04 -0400] "GET HTTP/1.0" 200 11992 "" "Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-CN; rv:1.8.0.11) Gecko/20070312 Firefox/1.5.0.11; 360Spider"
These all look like proxy requests, but some are (some of them) returning 200 responses, which is definitely NOT a good thing. I'm reasonably sure that mod_proxy isn't enabled anywhere, but it's possible it is. How do I rectify this?
03 Answers
Those have nothing to do with proxies. The web browsers that submitted those GET requests think that your server's IP address is just fine for the domain they're trying to reach. This could be for any number of reasons. Perhaps their DNS server is broken.
How to handle domain names that don't belong to your server
According to the Apache web server documentation, the first VirtualHost entry will be used to handle random hosts that you don't define in another VirtualHost entry:
Due to the fact that the virtual host with
ServerNameis first in the configuration file, it has the highest priority and can be seen as the default or primary server.
So, add a new VirtualHost entry before all others like the following:
<VirtualHost *:80> ServerName bad-domain ServerAlias * Redirect 404 / ErrorDocument 404 "Page Not Found"
</VirtualHost>Notice that the 404 responses are when the GET URL includes a sub-directory and that the 200 responses are when the GET URL does not include a sub-directory. For the 200 responses, the web page that is delivered is actually the document root web page from your site and not the GET URL.
Actually they can have something to do with a proxy... If you have set up Apache as a proxy (using ProxyRequests On in your config file) and you see those URLs with a 200 message, that means Apache happily downloaded the data from the distant server and sent it back to the client connected to your computer.
Source: spotted this on a customer's misconfigured Apache server.
