CONNECT xxx.xxx.xxx.xxx?

[skirril]

Hello, anyone seen this behaviour?

67.114.220.145 - - [09/Dec/2002:00:34:30 +0100] "CONNECT 207.46.181.13:25 HTTP/1.1" 400 307 "-" "-"

And I got 116 other lines vaguely similar.

Ideas?

[jeremy goodrich]

Appears to be a bot programmed to look for open proxies.

[Dreamquick]

Normally they would just use a GET if they were after open proxies, I'd expect to see a CONNECT used to check if the service allows connections on user-defined ports to be bounced through it.

Since CONNECT is normally disabled or unsupported if they got a good result then they could come back and do a more thorough test.

- Tony

[skirril]

so otherwise put, its ok to ban the ips

Skirril..