some kind of open relay ?
Posted: Mon May 09, 2005 11:17 am
Got the following in my log
211.55.209.131 - - [29/Apr/2005:16:37:57 +0100] "GET http://umsky.com/sproxy.php HTTP/1.0" 404 328
220.170.88.36 - - [01/May/2005:03:26:44 +0100] "GET http://www.yahoo.com/ HTTP/1.1" 200 1456
195.154.246.201 - - [01/May/2005:13:38:08 +0100] "GET / HTTP/1.0" 200 1456
82.53.153.215 - - [05/May/2005:15:18:34 +0100] "CONNECT 207.46.133.140:21 HTTP/1.0" 405 363
61.159.46.68 - - [07/May/2005:00:30:46 +0100] "GET http://www.online.sh.cn/ HTTP/1.1" 200 1456
This is an external facing, but unused, unpublished, Apache server on a non-default port. When I try to construct a url like that from a browser, I get a leading '/' in the log, and a 404 error, as expected.
I'm concerned at the apparently successful relays to yahoo etc.
Anyone know what they are, whether they're dangerous, how to stop them ?
211.55.209.131 - - [29/Apr/2005:16:37:57 +0100] "GET http://umsky.com/sproxy.php HTTP/1.0" 404 328
220.170.88.36 - - [01/May/2005:03:26:44 +0100] "GET http://www.yahoo.com/ HTTP/1.1" 200 1456
195.154.246.201 - - [01/May/2005:13:38:08 +0100] "GET / HTTP/1.0" 200 1456
82.53.153.215 - - [05/May/2005:15:18:34 +0100] "CONNECT 207.46.133.140:21 HTTP/1.0" 405 363
61.159.46.68 - - [07/May/2005:00:30:46 +0100] "GET http://www.online.sh.cn/ HTTP/1.1" 200 1456
This is an external facing, but unused, unpublished, Apache server on a non-default port. When I try to construct a url like that from a browser, I get a leading '/' in the log, and a 404 error, as expected.
I'm concerned at the apparently successful relays to yahoo etc.
Anyone know what they are, whether they're dangerous, how to stop them ?