httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "James - TheyWill.com, Inc." <ja...@theywill.com>
Subject RE: [users@httpd] Strange, Disconcerting Access Log Entries
Date Sun, 03 Nov 2002 15:18:44 GMT
I'm sorry, I should have included some additional information
that could make a difference in understanding the problem.

1.  The server does not have an open relay.
2.  The server's messages log does not indicate any unexpected
email transfers/connections at all.
3.  The IPs in the "CONNECT XXX.XXX.11.166:25" are all on other
networks.
4.  Again, these entries are from the Apache access log.
5.  The Apache error log does not have any unsual entries.
6.  The Apache version is 1.3.27.
7.  The server is running PHP as a module.

Thank you again for your feedback.

Best wishes,
James, james@theywill.com



> Looks like somebody is hitting your SMTP port, and
> probably is relaying
> messages off your server.
>
> On Sunday 03 November 2002 10:01 am, you wrote:
> > Hi there,
> >
> > In the past few days I've noticed thousands of very unusual
> > access log entries on an Apache VPS I operate.  I have
> > copied/pasted some entries below.  Parts of the IP
> addresses have
> > been marked with XXX for privacy reasons.
> >
> > XXX.XXX.230.51 - - [02/Nov/2002:00:03:05 -0700] "CONNECT
> > XXX.XXX.11.166:25 HTTP/1.0" 200 7811 "-" "-"
> > XXX.XXX.230.56 - - [02/Nov/2002:00:03:07 -0700] "CONNECT
> > XXX.XXX.63.52:25 HTTP/1.0" 200 7811 "-" "-"
> > XXX.XXX.230.54 - - [02/Nov/2002:00:03:15 -0700] "CONNECT
> > XXX.XXX.167.56:25 HTTP/1.0" 200 7811 "-" "-"
> > XXX.XXX.230.54 - - [02/Nov/2002:00:03:58 -0700] "CONNECT
> > XXX.XXX.160.11:25 HTTP/1.0" 200 63621 "-" "-"
> >
> > The IP:25 concerns me.  Notice too that the server
> status code is
> > 200.
> >
> > Any ideas as to what is going on here?
> >
> > Thank you in advance for your assistance.


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org


Mime
View raw message