Re: Apache log entries

From: Leo Leung (flare@nova.deep.space)
Date: 02/28/03 

From: "Leo Leung" <flare@nova.deep.space>
Date: Thu, 27 Feb 2003 15:16:15 -0800

That looks like be beginning of a raw SOCK5 Client connection?

"Kim S. Poulsen" <kspFJERN@akim.dk> wrote in message
news:fcor5v07o88dn85e0kkq76bmtetkqvshkc@4ax.com...
> I have been getting a lot of entries like this in my Apache access log
> recently. Besides trying to use my server as a mail proxy.
> Does anybody know what is the "\x05\x01\" is supposed to do?
> xxx.xx.dk 200.46.116.62 - - [23/Feb/2003:21:58:44 +0100] "CONNECT
> 200.24.139.146:25 HTTP/1.0" 200 849 "-" "-"
> xxx.xx.dk 200.46.116.62 - - [24/Feb/2003:01:43:41 +0100] "\x05\x01"
> 200 849 "-" "-"
> xxx.xx.dk 200.46.116.62 - - [24/Feb/2003:02:23:47 +0100] "\x05\x01"
> 200 849 "-" "-"
> --
> Kim S. Poulsen

Relevant Pages

  • Weird log entries...
    ... I was just shifting through my apache access log file and found some weird ... entries that caught my attention. ... After a quick search on the security focus ... server)...but Ive never really seen this bug, ...
    (Incidents)
  • Re: Apache log entries
    ... > I have been getting a lot of entries like this in my Apache access log ... Besides trying to use my server as a mail proxy. ...
    (comp.os.linux.security)
  • Re: Apache log entries
    ... >> I have been getting a lot of entries like this in my Apache access log ... Besides trying to use my server as a mail proxy. ... >Khay. ...
    (comp.os.linux.security)
  • Apache access log entries
    ... I have been getting a lot of entries like this in my Apache access log ... Besides trying to use my server as a mail proxy, ...
    (comp.security.firewalls)
  • Apache log entries
    ... I have been getting a lot of entries like this in my Apache access log ... Besides trying to use my server as a mail proxy. ...
    (comp.os.linux.security)