[linux-elitists] CONNECT <various>:25 attempts against Apache

Gustaf Erikson gustafe@home.se
Fri Sep 5 05:44:22 PDT 2003


"Nick 'Sharkey' Moore" <sharkey@zoic.org> writes:

> G'day,
>
> 	I'm not sure who else I'd ask ... has anyone else noticed
> a sudden influx of "CONNECT <whereever>:25 HTTP/1.0" requests
> coming into their webservers in the last, umm, 24 hours.
>
> 	I got two each on the 2nd, 3rd and 4th, and _564_ today.
>>From 33 different sources, against 323 different targets.
>
> I use mod_proxy on Apache, which I imagine it's detected,
> but it doesn't seem to realize that it'll never get anything
> other than "403" in return ...
>
> -----sharks

Looks "normal" here in sunny Stockholm, Sweden. 79 attempts in about a
year:

[ /var/www/logs ]# egrep "CONNECT .*:25" access_log  | wc -l
      79
[ /var/www/logs ]# egrep "CONNECT .*:25" access_log  | head -1
24.187.68.173 - - [17/Aug/2002:16:58:58 +0200] "CONNECT mailin-04.mx.aol.com:25 HTTP/1.0" 405 304
[ /var/www/logs ]# egrep "CONNECT .*:25" access_log  | tail -1
69.11.200.70 - - [19/Jul/2003:04:35:22 +0200] "CONNECT 65.54.254.151:25 HTTP/1.0" 405 304

/g.

-- 
Gustaf Erikson <<< mobile: 073-338 76 18 >>> http://stureby.net/gustaf/
The day Microsoft makes something that doesn't suck is probably the
day they start making vacuum cleaners. -- Ernst Jan Plugge



More information about the linux-elitists mailing list