Understanding nginx log statement

Question

I need some help in understanding following log statement found in /var/log/nginx/error log file.

2016/07/28 14:06:05 [error] 7255#7255: *712 open() "/usr/share/www/proj/check_proxy" failed (2: No such file or directory), client: 180.97.xxx.xxx, server: localhost, request: "GET http://180.163.xxx.xxx/check_proxy HTTP/1.1", host: "180.163.xxx.xxx"

How to read above log message? Especially what is server and what is host? Whenever I try to access the site, GET value in log message starts with slash(/) character. But in above log message it shows a URL. How can I reproduce above log message?

Interesting points in above log message are host IP is same as ip address in URL besides GET. nginx conf file doesn't contain localhost server name, yet it appears in server value in above log message. All other log messages show host as IP of machine, and server as server_name from nginx configuration file. Just a few observations based on my limited knowledge.

Thanks very much in advance.

Answer 1

I saw a similar request today and searched a bit.

Someone tried to access a file called http://180.163.xxx.xxx/check_proxy on your server, ie http://example.com/http://180.163.xxx.xxx/check_proxy , where example.com is your own domain.

This does look like an automated, and maybe misconfigured, scanner is looking for open and vulnerable proxy servers. I assume that normally they would check for http://example.com/check_proxy .