Help for understan access.log

Server NGINX
1

In my access.log I found this lines:

109.230.220.33 - - [02/Apr/2011:00:42:07 +0400] “GET
http://movies.yahoo.com// HTTP/1.0” 200 151 “-” “-”
95.132.30.204 - - [03/Apr/2011:02:06:24 +0400] “GET
http://www.google.com/ HTTP/1.0” 200 151 “-” “Mozilla/4.0 (compatible;
MSIE 6.0; Windows NT 5.1)”
109.230.222.236 - - [04/Apr/2011:16:56:03 +0400] “GET
http://XXX.XXX.XXX.XX/?login=sandart232&passwd=testing HTTP/1.0” 200 151
“-” “-”
109.230.222.236 - - [07/Apr/2011:12:50:14 +0400] “HEAD / HTTP/1.0” 200 0
“-” “-”
109.230.222.236 - - [07/Apr/2011:12:50:14 +0400] “HEAD / HTTP/1.0” 200 0
“-” “-”
109.230.222.236 - - [07/Apr/2011:12:50:15 +0400] “HEAD / HTTP/1.0” 200 0
“-” “-”
109.230.222.236 - - [07/Apr/2011:12:50:20 +0400] “HEAD / HTTP/1.0” 200 0
“-” “-”
109.230.222.236 - - [07/Apr/2011:12:50:56 +0400] “GET
http://maps.yahoo.com/ HTTP/1.0” 200 151 “-” “-”
109.230.222.236 - - [07/Apr/2011:12:50:56 +0400] “GET
http://maps.yahoo.com/ HTTP/1.0” 200 151 “-” “-”
175.138.46.45 - - [08/Apr/2011:08:35:28 +0400] “GET
http://answers.yahoo.com/ HTTP/1.0” 200 151 “-” “-”

What about this lines? People uses my web server like a proxy?
The http status code is 200…

Thank you.

Posted at Nginx Forum:

2

I think somebody telnet to your server and try GET documents from other
server

Try telnet to your server:

telnet YOURSERVERHOST 80

And paste text in brackets (with empty line):
{{{
GET http://maps.yahoo.com/ HTTP/1.0
Connection: close

}}}

and check your logs

Posted at Nginx Forum:

3

On Fri, Apr 08, 2011 at 09:53:47AM -0400, collaborando wrote:

109.230.222.236 - - [07/Apr/2011:12:50:14 +0400] “HEAD / HTTP/1.0” 200 0
http://maps.yahoo.com/ HTTP/1.0" 200 151 “-” “-”
175.138.46.45 - - [08/Apr/2011:08:35:28 +0400] “GET
http://answers.yahoo.com/ HTTP/1.0” 200 151 “-” “-”

What about this lines? People uses my web server like a proxy?
The http status code is 200…

They try to use it as proxy, but since response length is always 151
bytes, they get some default page.

–
Igor S.

4

Thanks to Igor S. and ewgra.

I tried to use telnet and in fact the log is the same. Telnet responds
with the default page of 151 bytes.

Bye.

Below the telnet attempt:

$ telnet myhost 80
Escape character is ‘^]’.
GET http://maps.yahoo.com/ HTTP/1.0
Connection: close

HTTP/1.1 200 OK
Server: nginx/0.8.54
Date: Wed, 13 Apr 2011 16:38:10 GMT
Content-Type: text/html
Content-Length: 151
Last-Modified: Sun, 27 Feb 2011 08:57:45 GMT
Connection: close
Accept-Ranges: bytes

Welcome to nginx!

Welcome to nginx!

Connection closed by foreign host.

Posted at Nginx Forum: