logging – proxy-host log from nginx is full of “:80/:80/:80/:80/:80/:80/:80/”

admin

I was playing around with nginx logs and i’ve noticed something strange, particularly that yahoo.com as well as internet-measurement.com requests are generating this

....
[01/Dec/2023:15:08:54 +0000] - 502 502 - GET xyz "/:80/:80/:80/:80/:80/:80/:80/:80/:80/:80/:80/:80/:80/:80/" [Client 34.231.60.151] [Length 556] [Gzip -] [Sent-to 192.168.1.52/] "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "http://www.yahoo.com"
[01/Dec/2023:15:08:54 +0000] - 502 502 - GET xyz "/:80/:80/:80/:80/:80/:80/:80/:80/:80/:80/:80/:80/:80/" [Client 34.231.60.151] [Length 556] [Gzip -] [Sent-to 192.168.1.52/] "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "http://www.yahoo.com"
[01/Dec/2023:15:08:54 +0000] - 502 502 - GET xyz "/:80/:80/:80/:80/:80/:80/:80/:80/:80/:80/:80/:80/" [Client 34.231.60.151] [Length 556] [Gzip -] [Sent-to 192.168.1.52/] "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "http://www.yahoo.com"
[01/Dec/2023:15:08:54 +0000] - 502 502 - GET xyz "/:80/:80/:80/:80/:80/:80/:80/:80/:80/:80/:80/" [Client 34.231.60.151] [Length 556] [Gzip -] [Sent-to 192.168.1.52/] "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "http://www.yahoo.com"
[01/Dec/2023:15:08:54 +0000] - 502 502 - GET xyz "/:80/:80/:80/:80/:80/:80/:80/:80/:80/:80/" [Client 34.231.60.151] [Length 556] [Gzip -] [Sent-to 192.168.1.52/] "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "http://www.yahoo.com"
[01/Dec/2023:15:08:54 +0000] - 502 502 - GET xyz "/:80/:80/:80/:80/:80/:80/:80/:80/:80/" [Client 34.231.60.151] [Length 556] [Gzip -] [Sent-to 192.168.1.52/] "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "http://www.yahoo.com"
[01/Dec/2023:15:08:54 +0000] - 502 502 - GET xyz "/:80/:80/:80/:80/:80/:80/:80/:80/" [Client 34.231.60.151] [Length 556] [Gzip -] [Sent-to 192.168.1.52/] "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "http://www.yahoo.com"
[01/Dec/2023:15:08:54 +0000] - 502 502 - GET xyz "/:80/:80/:80/:80/:80/:80/:80/" [Client 34.231.60.151] [Length 556] [Gzip -] [Sent-to 192.168.1.52/] "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "http://www.yahoo.com"
[01/Dec/2023:15:08:54 +0000] - 502 502 - GET xyz "/:80/:80/:80/:80/:80/:80/" [Client 34.231.60.151] [Length 556] [Gzip -] [Sent-to 192.168.1.52/] "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "http://www.yahoo.com"
[01/Dec/2023:15:08:54 +0000] - 502 502 - GET xyz "/:80/:80/:80/:80/:80/" [Client 34.231.60.151] [Length 556] [Gzip -] [Sent-to 192.168.1.52/] "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "http://www.yahoo.com"
[01/Dec/2023:15:08:54 +0000] - 502 502 - GET xyz "/:80/:80/:80/:80/" [Client 34.231.60.151] [Length 556] [Gzip -] [Sent-to 192.168.1.52/] "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "http://www.yahoo.com"
[01/Dec/2023:15:08:54 +0000] - 502 502 - GET xyz "/:80/:80/:80/" [Client 34.231.60.151] [Length 556] [Gzip -] [Sent-to 192.168.1.52/] "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "http://www.yahoo.com"
[01/Dec/2023:15:08:54 +0000] - 502 502 - GET xyz "/:80/:80/" [Client 34.231.60.151] [Length 556] [Gzip -] [Sent-to 192.168.1.52/] "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "http://www.yahoo.com"
[01/Dec/2023:15:08:54 +0000] - 502 502 - GET xyz "/:80/" [Client 34.231.60.151] [Length 556] [Gzip -] [Sent-to 192.168.1.52/] "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "http://www.yahoo.com"
[01/Dec/2023:15:08:54 +0000] - 502 502 - GET xyz "/" [Client 34.231.60.151] [Length 556] [Gzip -] [Sent-to 192.168.1.52/] "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" "http://www.yahoo.com"

Is there a way avoid this behaviour either by denying them or at least remove it from the logs?

Read more here: Source link