On 24.2.2012 10:17, Jussi Hirvi wrote: > On 24.2.2012 10.27, John R Pierce wrote: >> On 02/24/12 12:10 AM, Jussi Hirvi wrote: >>> ...when the DNS shows that the domain financeande.com is hosted >>> elsewhere? What kind of query can they have used? >> >> a forged one with a bogus vhost. > > I get almost similar entry, if I hit this on the browser: > > http://www.my_real_domain.com/http://bogus.com > > It shows like this in the log: > > > (...) - - [24/Feb/2012:11:12:27 +0200] "GET /http://bogus.com > HTTP/1.1" 404 292 "-" (...) > > Only here it starts with a slash (/http...), but in the original log > entry there was no slash. I'm still curious to know how this log entry > was born: > > > "GET http://financeande.com/feed/feed.php HTTP/1.1" 404 291 (...) > > - Jussi It was a check for proxy. you can try something like this: $ telnet www.my_real_domain.com 80 Trying ... Connected to www.my_real_domain.com. Escape character is '^]'. GET http://financeande.com/feed/feed.php HTTP/1.1 host: www.my_real_domain.com [double enter] -- Kind Regards, Markus Falb
Attachment:
signature.asc
Description: OpenPGP digital signature
_______________________________________________ CentOS mailing list CentOS@xxxxxxxxxx http://lists.centos.org/mailman/listinfo/centos
