Incidents
Re: Unusual entry in Apache logs May 30 2008 01:46PM
krymson gmail com
Probably a socks proxy scan.

<- snip ->

I have of late seen a few entries such as this ...

125.224.192.192 - - [29/May/2008:09:15:34 -0500] "\x05\x01" 501 3100 "-" "-"

... in my Apache webserver logs. They are the only entry in

the log for the particular source IP; that is, they don't

represent an anomaly in an otherwise normal session. Such

entries record the only contact made by the source IP.

GOOGLE hasn't told me anything interesting; does anyone know

what this is?

Many thanks for any ideas.

Best regards,

Neil Dickey, Ph.D.

email: neil (at) geol.niu (dot) edu [email concealed]

Research Associate/Sysop

Geology Department

Northern Illinois University

DeKalb, Illinois, U.S.A.

60115

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus