Back to list
Re: Unusual entry in Apache logs
May 30 2008 01:46PM
krymson gmail com
Probably a socks proxy scan.
<- snip ->
I have of late seen a few entries such as this ...
18.104.22.168 - - [29/May/2008:09:15:34 -0500] "\x05\x01" 501 3100 "-" "-"
... in my Apache webserver logs. They are the only entry in
the log for the particular source IP; that is, they don't
represent an anomaly in an otherwise normal session. Such
entries record the only contact made by the source IP.
GOOGLE hasn't told me anything interesting; does anyone know
what this is?
Many thanks for any ideas.
Neil Dickey, Ph.D.
email: neil (at) geol.niu (dot) edu [email concealed]
Northern Illinois University
DeKalb, Illinois, U.S.A.
[ reply ]
Copyright 2010, SecurityFocus