Apache日志疑惑

Yvan_Zhang

最近Apache的日志时常有这样的日志出现：

118.244.147.49 - - [28/Jul/2014:07:40:46 +0800] "GET http://www.baidu.com/?rands=14252436 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:47 +0800] "GET http://www.baidu.comhttp/www.baidu.com/?rands=14252436 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:47 +0800] "GET http://www.baidu.comhttphttp/www ... com/?rands=14252436 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:47 +0800] "GET http://www.baidu.comhttphttphttp ... com/?rands=14252436 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:47 +0800] "GET http://www.baidu.comhttphttphttp ... com/?rands=14252436 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:47 +0800] "GET http://www.baidu.comhttphttphttp ... com/?rands=14252436 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:47 +0800] "GET http://www.baidu.comhttphttphttp ... com/?rands=14252436 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:48 +0800] "GET http://www.baidu.comhttphttphttp ... com/?rands=14252436 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:48 +0800] "GET http://www.baidu.comhttphttphttp ... com/?rands=14252436 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:48 +0800] "GET http://www.baidu.comhttphttphttp ... com/?rands=14252436 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:48 +0800] "GET http://www.baidu.comhttphttphttp ... com/?rands=14252436 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:48 +0800] "GET http://116.255.157.223:800/proxyheader.php?rands=78214002 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:49 +0800] "GET http://www.soso.com/?rands=78214002 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:49 +0800] "GET http://www.soso.comhttp/www.soso.com/?rands=78214002 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:49 +0800] "GET http://www.soso.comhttphttp/www. ... com/?rands=78214002 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:49 +0800] "GET http://www.soso.comhttphttphttp/ ... com/?rands=78214002 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:49 +0800] "GET http://www.soso.comhttphttphttph ... com/?rands=78214002 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:49 +0800] "GET http://www.soso.comhttphttphttph ... com/?rands=78214002 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:50 +0800] "GET http://www.soso.comhttphttphttph ... com/?rands=78214002 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:50 +0800] "GET http://www.soso.comhttphttphttph ... com/?rands=78214002 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:50 +0800] "GET http://www.soso.comhttphttphttph ... com/?rands=78214002 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:50 +0800] "GET http://www.soso.comhttphttphttph ... com/?rands=78214002 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:50 +0800] "GET http://www.soso.comhttphttphttph ... com/?rands=78214002 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:51 +0800] "GET http://reg.163.com/?rands=55165665 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:51 +0800] "GET http://reg.163.comhttp/reg.163.com/?rands=55165665 HTTP/1.1" 301 3
118.244.147.49 - - [28/Jul/2014:07:40:51 +0800] "GET http://reg.163.comhttphttp/reg.1 ... com/?rands=55165665 HTTP/1.1" 301 3

看着具体条目，总觉得像是我的公网IP被别人当作代理IP使用了，请教各位大拿如何通过设置，让Apache日志不再出现类似记录。

q1208c

你怎么知道是被当作代理了呢?

这log显示全是 301. 要看你的配置, 把这些url 301 到了哪里了.

另外, 你有没有用过 proxy mod ?

Yvan_Zhang

回复 2# q1208c


   只是猜测，觉得是被当代理了。因为这些目标网站不是我的服务器上，我无法准确解释这些日志出现的具体原因。其次Apache的proxy模块我确认是没有开启的

q1208c

回复 3# Yvan_Zhang

从域名看, 访问的全是 搜索引擎.

如果你的网站使用了第三方搜索引擎, 又没有正确设置, 有可能有这些访问产生.

你可以看一下这些访问的 refer是哪些.

另外, 如果数量不是很大, 并且, 只是搜索引擎的话, 应该不是 攻击 或者被 黑成了代理.

当然, 最好能分析一下 进来的IP是哪些. 如果只有一两个, 那还是要特别留意一下.
   

jackyyen

是不是来源IP把这几个网站都指向你的服务器了