On Nov 3, 2007 12:40 PM, Roger Haase <haaserd@xxxxxxxxx> wrote: > About once a week or more often, I get some unusual entries in my apache log > file similar to these: > > > 159.148.97.91 - - [31/Oct/2007:23:44:31 -0700] "CONNECT 195.175.37.70:8080 > HTTP/1.0" 302 102 "-" "-" > 159.148.97.91 - - [31/Oct/2007:23:44:32 -0700] "CONNECT 159.148.96.222:80 > HTTP/1.0" 302 102 "-" "-" > 159.148.97.91 - - [31/Oct/2007:23:44:32 -0700] "GET > http://www.hi.lv:80/counter1.php HTTP/1.0" 404 284 "-" "-" > 159.148.97.91 - - [31/Oct/2007:23:44:33 -0700] "GET > http://www.hi.lv:80/counter1.php HTTP/1.0" 404 284 "-" "-" > I am in Arizona and the traffic seems to originate in Amsterdam. The > www.hi.lv host apears to be in Latvia. My IP address is no where near > 195.175.37.70 or 159.148.96.222. On the other occasions, the urls are from > other equally strange locations and never seem to repeat. On most > occasions, there is only one entry at a time. > > Is this misdirected internet junk that I should report to my ISP as their > problem or is this a hacker attempt? See: http://wiki.apache.org/httpd/ProxyAbuse Joshua. --------------------------------------------------------------------- The official User-To-User support forum of the Apache HTTP Server Project. See <URL:http://httpd.apache.org/userslist.html> for more info. To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx " from the digest: users-digest-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx
|