Odd log entries: is it indicative of an attack?, is there anything other than IP blocking that I should do? [closed]

Question

So I've been getting some odd log entries in my Drupal 7 install: Here's two:

As far as I can see they haven't done anything and I've blocked the IP addresses but they keep coming with different IP addresses so I'm wonder what they actually mean? Like if they were for manager/html I'd know they were (probably automated) attack testing for Apache Tomcat apps to hack. But these with a location that isn't even my site I'm confused by. Also wondering why the message starts with ttp:// instead of http:// or something normal.

Answer 1

Well continued my research and a day without no answer was enough time for me to figure it out. As I suspected yes this is an attempted attack/test. It is not specifically an attack on Drupal although it does show up in the Drupal log.

Specifically this is checking to see if your server is set up in such a way that it can be used as an open proxy; in other words if you give it a get request for a domain it doesn't serve will it GET the content from the right server and pass it on. This is bad without a login, since it lets anyone appear to be your server while they are spamming/etc - see the Apache Proxy Abuse Page.

In this case since Apache passed the request on to the virtual hosts it shows that the server is not configured as an open proxy and is safe (at least from that attack vector at this time). The server logs show a 404 as well which confirms that either the url was invalid or that there is no open proxy:

125.64.35.67 - - [03/Dec/2014:08:08:52 -0500] "GET http://6.url.cn/zc/chs/img/body.png HTTP/1.1" 404 716 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.3072; .NET CLR 2.0.50727; .NET CLR 3.0.30729; Tablet PC 2.0)"

If it was a successful attack test/attack it wouldn't appear in the Drupal logs, only in the server logs. In the server logs it would appear something like:

125.64.35.67 - - [03/Dec/2014:08:08:52 -0500] "GET http://6.url.cn/zc/chs/img/body.png HTTP/1.1" 200 716 "-" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.3072; .NET CLR 2.0.50727; .NET CLR 3.0.30729; Tablet PC 2.0)"

with a response code that indicates a valid resource.

As to why the Drupal log strips the initial h for the message I don't know and it doesn't really matter; that being said if I have time I'll probably investigate it and submit a patch to fix it.