Hi

I am getting strange http requests logged in my apache logs for sites
that do not exist on my server.

"GET http://www.bdsmreality.com/cgi-bin/r...cgi?id=maxbdsm HTTP/1.0"
200 199 "http://www.maxbdsm.com/linkspage.html" "Mozilla/4.7 (Macintosh;
U; PPC)"


Anyone come across this before??

rowlando

Davide Bianchi wrote:
> On 2006-10-13, rowlando <rowlando@spamtrap.co.uk> wrote:
>
>>I am getting strange http requests logged in my apache logs for sites
>>that do not exist on my server.
>>"GET http://www.bdsmreality.com/cgi-bin/r...cgi?id=maxbdsm HTTP/1.0"
>>200 199 "http://www.maxbdsm.com/linkspage.html" "Mozilla/4.7 (Macintosh;
>
>
> Someone is trying to use your system as an open relay to 'hide' his
> own IP. The size of the returned page (199 bytes) make me think that he
> is getting your standard homepage or nothing at all. Put his IP
> in your firewall and (if you're a real bastard) drop a mail to his ISP
> or employer.
>
> Davide
>

Thanks Davide.

Isnt this person succeeding??? After all the get requests return a 200 code.


rowlando

On 2006-10-13, rowlando <rowlando@spamtrap.co.uk> wrote:
> I am getting strange http requests logged in my apache logs for sites
> that do not exist on my server.
> "GET http://www.bdsmreality.com/cgi-bin/r...cgi?id=maxbdsm HTTP/1.0"
> 200 199 "http://www.maxbdsm.com/linkspage.html" "Mozilla/4.7 (Macintosh;

Someone is trying to use your system as an open relay to 'hide' his
own IP. The size of the returned page (199 bytes) make me think that he
is getting your standard homepage or nothing at all. Put his IP
in your firewall and (if you're a real bastard) drop a mail to his ISP
or employer.

Davide

--
Linux: transforms your microcomputer in a workstation.
Windows NT: transforms your workstation in a microcomputer.
-- Paulo F. Sedrez

Davide Bianchi wrote:
> On 2006-10-13, rowlando <rowlando@spamtrap.co.uk> wrote:
>
>>>>200 199 "http://www.maxbdsm.com/linkspage.html" "Mozilla/4.7 (Macintosh;
>>>
>>Isnt this person succeeding??? After all the get requests return a 200 code.
>
>
> Yes, and 199 bytes of data. That is a little too short for a full size
> homepage... as I said: put his IP in your firewall.
>
> Davide
>
Excellent stuff.

thanks

On 2006-10-13, rowlando <rowlando@spamtrap.co.uk> wrote:
>>>200 199 "http://www.maxbdsm.com/linkspage.html" "Mozilla/4.7 (Macintosh;
>>
> Isnt this person succeeding??? After all the get requests return a 200 code.

Yes, and 199 bytes of data. That is a little too short for a full size
homepage... as I said: put his IP in your firewall.

Davide

--
If you can read this your hard drive is about this rooted!