[Dshield] Apache Question

Axel Pettinger api at worldonline.de
Wed May 11 21:55:30 GMT 2005


Hi,

Did you try to telnet to address and port? The computer replies with the following and then disconnects:

L9G90WDS0ZY2JMMPU1C7EP0XJ205A5CTI1TLJ6S8R77EL20DAKQPSEE728WV2ZD44AY3GC4JL0W69AYY 

Whatever that may mean ...


The IP belongs to a German IT company:
"Probe Networks - security solutions for your e-business"

"keywords" content="Server, Hosting, Linux, Security, IT, Business, Dienstleistung, Service, Beratung, Consulting"

Abuse address: abuse at probe-networks.de

http://www.probe-networks.de/index.php?section=impressum&page=impressum

Regards,
Axel Pettinger


-------- Original Message --------
Subject: [Dshield] Apache Question
Date: Wed, 11 May 2005 17:20:30 -0400
From: Joel Esler <esler at knology.net>
Reply-To: General DShield Discussion List <list at lists.dshield.org>
To: General DShield Discussion List <list at lists.dshield.org>
References: <003b01c5525b$a3885690$654b5b82 at shakuhachi><427BAF65.7050106 at euclidian.com> <42823954.9020409 at ieee.org>

Like to get everyone's input on this one:

 From an apache log..

82.96.96.3 - - [10/May/2005:22:52:59 -0400] "POST 
http://82.96.96.3:802/ HTTP/1.0" 200 55296 "-" "-"
82.96.96.3 - - [10/May/2005:22:52:59 -0400] "CONNECT 82.96.96.3:802 
HTTP/1.0" 405 329 "-" "-"

What do we make of this?

Joel

-------------- Sponsor Message ------------------------------------
Join us at SANSFIRE 2005 in Atlanta!
The Internet Storm Center Conference.
Details: http://www.sans.org/sansfire2005

_______________________________________________
send all posts to list at lists.dshield.org
To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list



More information about the list mailing list