Forum Moderators: DixonJones
218.19.142.36 - - [16/Feb/2003:15:11:47 -0500] "\x04\x01" 200 12288 "-" "-"
218.19.142.36 - - [16/Feb/2003:15:12:08 -0500] "\x05\x01" 200 12288 "-" "-"
218.19.142.36 - - [16/Feb/2003:15:12:08 -0500] "CONNECT 202.106.185.77:80 HTTP/1.1" 200 12119 "-" "-"
I searched and couldn't find any info about these.
Any ideas?
thanks
The third could be a standard connection attempt by someone using telnet, seeing exactly what your server returns. It may also be someone who is trying to use your server as a proxy, and is trying to connect to another server through yours. The request for another IP address is odd too.
Inital thoughts are that it could be a script kiddie, or someone doing a general port scanner? This is something which happens to lots of servers every day. I'd suggest keeping an eye on the logs. If it's not happening often, then it probably isn't anything to be too concerned about. I see lots of similar occurrances in the logs - spanning every IP address that my servers are on - which indicates it's just someone doing a scan to see whats there.
When did you first see these attempts?
JP
That was the first one, 11 days ago.
Does one of the quoted dashes "-", represent the http_user_agent?
If so, I could block that user_agent.
