Re: [squid-users] Squid Reverse Proxy. Attempted connections to domains we do not host?

On Monday 12 August 2013 at 09:18:24, PSA4444 wrote:

> We are seeing entries like this in our squid access log:
>
> 1376290358.781 151 198.2.208.203 TCP_MISS/200 916 GET
> http://toolbarqueries.google.com.hk/tbr? - HIER_DIRECT/74.125.237.18
> text/html

People (or rather, bots) searching for open proxies...

> How can this one even happen:
> 1376291144.757 879 216.244.78.166 TCP_MISS/302 1057 GET
> http://203.208.46.128/search? - HIER_DIRECT/203.208.46.128 text/html ?

The URL (in this case, an IP address) you see in the GET request is not
necessarily the same as the IP they connected to...

> No idea what this means. I know I could add entries like this by creating
> a hosts file entry to point fake.domain.com to our server but surely it's
> not people doing this?

Bots.

Is there a good reason why your Squid is listening on a pub;lic IP address?

Antony.

-- 
"Once you have a panic, things tend to become rather undefined."
 - murble
                                                     Please reply to the list;
                                                           please don't CC me.