Re: Strange Web Server Log Entries

[Allan Wind <allan_wind () lifeintegrity com>]

On 2007-12-06T15:24:24-0600, Sean Malloy wrote:
> What do these entries in my Apache logs mean?
>
> 65.117.101.194 - - [20/Nov/2007:09:25:39 -0600] "GET http://www.microsoft.com/ HTTP/1.0" 200 2770

It means the client is using your web server as a proxy, and appears 
to be succeeding for GETs (but not connect and post).  You would need to  
compare the output of said response with what you get from microsoft.com 
to confirm.  For instance:

telnet $host $port
GET http://www.microsoft.com/ HTTP/1.0

Your favorite search engine will probably present you with tools to do 
this for you in a browser if you ask it nicely.  A few problems with 
open proxies is that that client waste your resources, and if they 
attach a 3rd party then law enforcement would come and knock on your 
door rather than theirs (hopefully to start with).


/Allan