| Welcome to WebmasterWorld Guest from 22.214.171.124 |
register, login, search, subscribe, help, library, PubCon, announcements, recent posts, open posts,
|Pubcon Platinum Sponsor|
| 8:07 pm on Dec 9, 2002 (gmt 0)|
Hello, anyone seen this behaviour?
126.96.36.199 - - [09/Dec/2002:00:34:30 +0100] "CONNECT 188.8.131.52:25 HTTP/1.1" 400 307 "-" "-"
And I got 116 other lines vaguely similar.
| 8:15 pm on Dec 9, 2002 (gmt 0)|
Appears to be a bot programmed to look for open proxies.
| 8:27 pm on Dec 9, 2002 (gmt 0)|
Normally they would just use a GET if they were after open proxies, I'd expect to see a CONNECT used to check if the service allows connections on user-defined ports to be bounced through it.
Since CONNECT is normally disabled or unsupported if they got a good result then they could come back and do a more thorough test.
| 10:04 pm on Dec 9, 2002 (gmt 0)|
so otherwise put, its ok to ban the ips
All trademarks and copyrights held by respective owners. Member comments are owned by the poster.
WebmasterWorld ® and PubCon ® are a Registered Trademarks of Pubcon Inc.
© Pubcon Inc. 1996-2012 all rights reserved