http://www.example.com/http://www.example.com/ in Apache log?

Question

I run a website, let's say http://www.example.com/. On it I have a path and file, say http://www.example.com/path/file.html. The Apache log lists GET requests like

GET /path/file.html HTTP/1.1

which is correct, corresponding to http://www.example.com/path/file.html; such lines result in a 200 status code and everything's good. But then I have other entries

GET http://www.example.com/path/file.html HTTP/1.1

or

GET http://www.othersite.net/ HTTP/1.1

which would correspond to something like http://www.example.com/http://www.example.com/path/file.html or http://www.example.com/http://www.othersite.net/ which do not exist. (My server returns a 404 for these.) These requests are always from far away (Italy, Latvia, ...) while actual users of my website are invariably local. What are these? Is there any particular reason for these requests? Have others seen these happen?

It's been going on for at least a year and it's continuous (though I'm not being flooded).

These aren't transparent attacks like

GET //mysql-admin/ HTTP/1.1

and

GET /webdav/test HTTP/1.1

but they're too common to be confused people playing with HTTP manually.

Answer 1

GET http://www.example.com/path/file.html HTTP/1.1
GET http://www.othersite.net/ HTTP/1.1

These are attempts to use your server as a HTTP proxy; that's what a full URL rather than a path in the request means. These are attempts to misuse your server as an open proxy, which it is properly rejecting.

Giving the full URL while requesting a page from your own site may also be the result of broken HTTP clients.

Don't worry about it as long as you have 4xx responses in your logs.