Re: Strange entries in Apache access_log

From: Sven Koch (haegarat_private)
Date: Sat Sep 01 2001 - 12:42:33 PDT

  • Next message: H C: "Re: Code Red - A Possible Origin?"

    On Thu, 30 Aug 2001, Ryan Russell wrote:
    
    > > 63.251.5.46 - - [30/Aug/2001:09:20:04 +0200] "GET
    > > http://www.yahoo.com/index.html HTTP/1.1" 200 2890
    >
    > We get stuff like this every once in a while on our web servers.  I don't
    > know why.  I imagine it could happen if someone's DNS got confused or
    > modified... but I don't know what the point is.
    
    This looks like the standard way to check if this box is an open proxy.
    
    But the returncode 200 is strange - our apache-boxes return 404 when
    trying this.
    
    c'ya
    sven
    
    -- 
    
    The Internet treats censorship as a routing problem, and routes around it.
    (John Gilmore on http://www.cygnus.com/~gnu/)
    
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Sun Sep 02 2001 - 02:23:19 PDT