Question: My Apache web server logged following messages to `access.log`:

```
46.22.173.131 - - [23/Dec/2014:15:34:54 +0100] "GET http://pl.wikipedia.org/wiki/Special:Search?search=&go=Go HTTP/1.1" 302 482 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)"
182.254.156.77 - - [23/Dec/2014:16:53:22 +0100] "GET http://www.ly.com/ HTTP/1.1" 302 433 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0"`
182.254.208.62 - - [23/Dec/2014:17:57:49 +0100] "GET http://www.ly.com/ HTTP/1.1" 302 433 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:29.0) Gecko/20100101 Firefox/29.0"

```

I have two `Virtualhost`s defined - one for port 80 which just redirects to 443 ... and the `Virtualhost` for port 443 which logs into `ssl_access.log`.

I do not understand what these logs mean? Was someone trying to get to these URLs through my web server?

Please help me understand those logs.

Merry Christmas everyone!

Answer: 
<http://wiki.apache.org/httpd/ProxyAbuse>: 

> 
> Why do I see requests for foreign sites appearing in my log files?
> 
> 
> An access\_log entry showing this situation could look like this:
> 
> 
> 63.251.56.142 - - [25/Jul/2002:12:48:04 -0700] "GET <http://www.yahoo.com/> HTTP/1.0" 200 1456  
> 
>  For this log line, the 200
>  code (second to last field in this example) indicates that the request
>  was successful – but see below for an explanation of what “success”
>  means in this situation.
> 
> 
> This is usually the result of malicious clients trying to exploit open
>  proxy servers to access a website without revealing their true
>  location. They could be doing this to manipulate pay-per-click ad
>  systems, to add comment or link-spam to someone else's site, or just
>  to do something nasty without being detected.
> 
> 
> It is important to prevent your server from being used as an open
>  proxy to abuse other sites.
> 
> 
>
In addition to the great answer from faker, the `302` response code is because of the HTTPS redirect you have configured.

To verify if you are vulnerable to the same exploit via HTTPS, run these commands [[source]](http://www.bearfruit.org/2008/04/17/telnet-for-testing-ssl-https-websites/):

```
openssl s_client -connect yourdomain.com:443
[wait for the connection to initialise]
GET http://www.yahoo.com/ HTTP/1.1
Host: www.yahoo.com

```

Or with `curl`:

```
curl -H -x https://domain.name.here:443 www.google.de

```

As per the [Apache documentation](http://wiki.apache.org/httpd/ProxyAbuse), you should not receive content from yahoo.com and should either display a 404 or 403 response. If this happens, these logs are nothing to worry about and are more than likely automated scanning done by bots.