httpd-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Mark Feather" <markfeat...@customnet.co.uk>
Subject [users@httpd] Strange entry in Access Log
Date Fri, 18 Feb 2005 14:57:42 GMT
I have received this entry in my Apache2 access log for the second time since Xmas and would
like to know more about it, what the visitor has done to create the entry and what is the
visitor trying to achieve.

221.237.160.164 - - [18/Feb/2005:02:46:24 +0000] "GET http://www.sina.com.cn/ HTTP/1.1" 200
5816 "-" "Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)"

These are the only such entries i have come across so far, i can find no others that are similar
in any way.


On both occasions the visitor has the same IP Address using Win95.

As far as i can tell (i'm no expert here) my Proxy server is disabled and i have all ports
to my Server blocked except the ports 20, 21, 22 and 80.

I have from within my LAN on a Win98 machine tried to reproduce this entry and failed, one
method was to alter the IE settings to try and establish a connection to a proxy server on
my Linux box through port 80 which failed, all i get displayed on my Win98 machines screen
is the default index page of my server and a set of very different entries in my servers access
log having tried to surf several websites elsewhere in the world using a set of proxy settings.
  From this i am sure that i do not have a proxy server enabled at all.

But what is the visitor trying to do here and how is the visitor doing it?   And finally do
i have anything to worry about here?

Mark
Mime
View raw message