Security Incidents mailing list archives
http activity
From: Burak DAYIOGLU <dayioglu () METU EDU TR>
Date: Wed, 21 Mar 2001 10:03:09 +0200
Hello, Surfing through logs of one web server box, I found out these four lines, which I couldn't figure out. The first line is not a mistake, but seems to be a purposeful inspection. I searched through the net but couldn't be able to find out info on a phpads exploit. The remaining three lines are awkward. First, the dates... Last two lines have dates with reverse order (i.e. latter line should have been logged earlier). The time settings on the box seem to be ok as well as no signs of any intrusions. Furthermore, with the last three lines, it looks like someone has had been in search for an open-proxy what then what the heck is the syntax error in it? I guess http:/ should have been http://, am I missing something? Can someone help me figure out these? cheers, Burak DAYIOGLU X.X.X.X - - [19/Mar/2001:23:17:39 +0200] "GET /adserver/phpads.php3?what=140x60&n=tr HTTP/1.1" 404 226 X.X.X.X - - [20/Mar/2001:01:52:03 +0200] "GET /"http:/some-domain.com", HTTP/1.0" 404 217 X.X.X.X - - [20/Mar/2001:03:54:36 +0200] "GET /"http:/some-domain.com", HTTP/1.0" 404 217 X.X.X.X - - [20/Mar/2001:03:43:14 +0200] "GET /"http:/some-domain.com", HTTP/1.0" 404 217
Current thread:
- http activity Burak DAYIOGLU (Mar 21)
- Re: http activity Hugo van der Kooij (Mar 21)
- Re: http activity Michael Katz (Mar 21)
- <Possible follow-ups>
- Re: http activity Justin Shore (Mar 21)
- Re: http activity sgtphou (Mar 23)
