Security Incidents: Re: Unusual entry in Apache logs

[Rob Thomas <robt () cymru com>]

Hi, Neil.

> 125.224.192.192 - - [29/May/2008:09:15:34 -0500] "\x05\x01" 501 3100 "-" "-"
This IP has been sending spam since at least 2008-04-24 15:34:38 UTC. 
It's also been scanning for the typical proxy ports lately (most 
recently 2008-05-29 02:34:16 UTC), e.g. TCP 8080, TCP 3128, TCP 1080, 
and TCP 80.  I suspect this is what it was doing when it visited your 
server.  Possibly it's a bot.
Thanks,
Rob.
--
Rob Thomas
Team Cymru
The WHO and WHY team
http://www.team-cymru.org/