501 Error Code in Server Log

User Agent is Opera/9.50 (Nintendo DSi)

[grandma genie]

Hi Everyone,

I was checking my server logs today and found these entries that I have never seen before. They are from two different IPs, but they both have the same User_Agent string:

76.99.203.nn - - [14/Nov/2010:21:30:24 -0500] "GET /picture.jpg HTTP/1.1" 200 24601 "mywebsite.com/cats" "Opera/9.50 (Nintendo DSi; Opera/507; U; en-US)"
76.99.203.nn - - [14/Nov/2010:21:30:25 -0500] "\x01\x01\x05" 501 304 "-" "-"


71.79.167.nnn - - [14/Nov/2010:12:33:45 -0500] "GET /file1/file2/image.jpg HTTP/1.1" 200 7740 "mywebsite.com/gifts/stuff.html" "Opera/9.50 (Nintendo DSi; Opera/507; U; en-US)"
71.79.167.nnn - - [14/Nov/2010:12:33:45 -0500] "\x01\x01\x05\x1a\xbb\x82\x92+\xbb\x82\x9c;\xbb\x82\x82;\xbb\x82\x8c\xdb\xbb\x82rK\xbb\x82|\image.jpg HTTP/1.1" 400 315 "-" "-"

The visitors seem to be just visiting via some type of mobile device. Why is the server throwing those odd errors? I checked Google and Webmasterworld but couldn't find anything that might answer the question. Does this look familiar to anyone? I am on a hosted Apache server. Should I be worrying?

Grandma_genie

[sublime1]

An HTTP request should have a verb (e.g. "GET"), a space, the URI requested, a space, then the protocol and version (e.g. "HTTP/1.1").

The first error contains neither the verb nor the protocol, and this may be enough to trigger a server error 501 which means "Not Implemented".

The second error contains no verb but does contain the protocol, and returns the 400 error ("Bad Request"), as it should.

In short, the mobile device or its version of Opera have not implemented the HTTP protocol correctly. Your server is responding fine.

Tom

[grandma genie]

Hi sublime1,
Does that mean the visitor did not set up his device correctly? In other words, is the visitor responsible for what is happening, or is the browser making the error, sort of like when someone is dragging around adware or spyware and doesn't know it. Too bad we can't let people know when these types of things are happening.
Grandma_genie

[sublime1]

It's impossible to know with the data you have.

[caribguy]

This 'user' is trying to execute shellcode and cause a buffer overflow. i.e. it's scanning for vulnerabilities on your server. A search for \x01\x01\x05 brings up some interesting results.