On 08/12/2013 10:56 AM, Antony Stone wrote: > On Monday 12 August 2013 at 09:18:24, PSA4444 wrote: > >> We are seeing entries like this in our squid access log: >> >> 1376290358.781 151 198.2.208.203 TCP_MISS/200 916 GET >> http://toolbarqueries.google.com.hk/tbr? - HIER_DIRECT/74.125.237.18 >> text/html > > People (or rather, bots) searching for open proxies... > The main problem is not that people use your reverse proxy but rather why your proxy as a reverse proxy serves these queries?? if you would share your squid.conf(not in public) I would be happy to assist you fix the main issues with it. Eliezer >> How can this one even happen: >> 1376291144.757 879 216.244.78.166 TCP_MISS/302 1057 GET >> http://203.208.46.128/search? - HIER_DIRECT/203.208.46.128 text/html ? > > The URL (in this case, an IP address) you see in the GET request is not > necessarily the same as the IP they connected to... > >> No idea what this means. I know I could add entries like this by creating >> a hosts file entry to point fake.domain.com to our server but surely it's >> not people doing this? > > Bots. > > Is there a good reason why your Squid is listening on a pub;lic IP address? > > > Antony. >
