[Dshield] Apache Question

bugtraq@cgisecurity.net bugtraq at cgisecurity.net
Wed May 11 22:09:42 GMT 2005


Someone is checking to see if your web server allows relaying.

- zeno
http://www.cgisecurity.com

> 
> I've had a few lately myself similar to this.  I am still
> investigating it on my end, including packet capture for the entire
> conversation.
> 
> Jim McCullough
> irc.freenode.net
> #dshield/#dshielders
> 
> On 5/11/05, Joel Esler <esler at knology.net> wrote:
> > Like to get everyone's input on this one:
> > 
> >  From an apache log..
> > 
> > 82.96.96.3 - - [10/May/2005:22:52:59 -0400] "POST
> > http://82.96.96.3:802/ HTTP/1.0" 200 55296 "-" "-"
> > 82.96.96.3 - - [10/May/2005:22:52:59 -0400] "CONNECT 82.96.96.3:802
> > HTTP/1.0" 405 329 "-" "-"
> > 
> > What do we make of this?
> > 
> > Joel
> > 
> > -------------- Sponsor Message ------------------------------------
> > Join us at SANSFIRE 2005 in Atlanta!
> > The Internet Storm Center Conference.
> > Details: http://www.sans.org/sansfire2005
> > 
> > _______________________________________________
> > send all posts to list at lists.dshield.org
> > To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list
> > 
> 
> 
> -- 
> Jim McCullough
> 
> -------------- Sponsor Message ------------------------------------
> Join us at SANSFIRE 2005 in Atlanta!
> The Internet Storm Center Conference.
> Details: http://www.sans.org/sansfire2005
> 
> _______________________________________________
> send all posts to list at lists.dshield.org
> To change your subscription options (or unsubscribe), see: http://www.dshield.org/mailman/listinfo/list
> 




More information about the list mailing list