Apache access log shows these attack requests

Bob bob at a1poweruser.com
Tue Jun 12 20:54:49 UTC 2007


Running FBSD 6.2 + apache 13. In the apache access log I see these log
records.
To me it looks like my apache server is servicing connect requests and get
requests to other URL's.
Is there some configuration option I can turn on to stop my server from
servicing these bogus requests?

122-124-129-27.dynamic.hinet.net - - [04/May/2007:04:38:18 -0400] "CONNECT
220.1
122-124-129-27.dynamic.hinet.net - - [04/May/2007:04:38:19 -0400] "CONNECT
220.1
122-124-129-27.dynamic.hinet.net - - [04/May/2007:04:38:20 -0400] "CONNECT
220.1
122-124-129-55.dynamic.hinet.net - - [10/May/2007:18:29:38 -0400] "CONNECT
220.1
122-124-129-55.dynamic.hinet.net - - [10/May/2007:18:29:38 -0400] "CONNECT
220.1
122-124-129-55.dynamic.hinet.net - - [10/May/2007:18:29:39 -0400] "CONNECT
220.1
kaista.fi - - [03/May/2007:01:35:44 -0400] "GET http://pro_xy.t35.com/AZ.php
HTT
kaista.fi - - [03/May/2007:01:35:45 -0400] "GET http://pro_xy.t35.com/AZ.php
H
12.40.60.226 - - [04/May/2007:05:30:14 -0400] "GET
http://www2.andrews.edu/~bidw
12.40.60.226 - - [04/May/2007:05:30:15 -0400] "GET
http://www.anonymitytest.com/
217.194.139.131 - - [08/May/2007:05:22:03 -0400] "GET
http://pro_xy.t35.com/AZ.p
217.194.139.131 - - [08/May/2007:05:22:12 -0400] "GET
http://pro_xy.t35.com/AZ.p
62.159.66.106 - - [09/May/2007:23:57:42 -0400] "GET
http://pro_xy.t35.com/AZ.php
62.159.66.106 - - [09/May/2007:23:57:42 -0400] "GET
http://pro_xy.t35.com/AZ.php
r - - [10/May/2007:09:42:40 -0400] "\x04\x01\x1a\vE\x10\xac\"" 400 - "-" "-"
r - - [10/May/2007:09:42:50 -0400] "\x05\x01" 200 7036 "-" "-
89.196.37.169 - - [15/May/2007:02:50:21 -0400] "GET
http://www.internetsec.org/a
89.196.37.169 - - [15/May/2007:02:50:37 -0400] "\x04\x01" 200 7036 "-" "-"
89.196.37.169 - - [15/May/2007:02:50:52 -0400] "\x05\x01" 200 7036 "-" "-"
89.196.21.158 - - [21/May/2007:06:17:46 -0400] "GET
http://thecric.free.fr/AZenv
89.196.21.158 - - [21/May/2007:06:18:02 -0400] "\x04\x01" 200 7036 "-" "-"
89.196.21.158 - - [21/May/2007:06:18:17 -0400] "\x05\x01" 200 7036 "-" "-"
host37.kaisha.co.uk - - [10/Jun/2007:15:27:52 -0400] "GET
http://pro_xy.t35.com/
host37.kaisha.co.uk - - [10/Jun/2007:15:27:53 -0400] "GET
http://pro_xy.t35.com/




More information about the freebsd-questions mailing list