Re: What is this request looking for?
Yehuda Katz <[email protected]> Fri, 6 Feb 2026 16:21:18 -0500
| Newsgroups | gmane.comp.apache.user |
|---|---|
| Message-ID | <CAGBAQ447hgfUFp4oH2WCoQ6uOBt7pcKOzZqwmBYSV4zVBSxHJQ@mail.gmail.com> |
--000000000000537003064a2e5f8c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I recommend fail2ban to set a block after some number of 408s for a single IP. There are a lot of forum/QA posts about this specific filter - example: https://security.stackexchange.com/questions/155941/blocking-slowloris-usin= g-fail2ban-what-are-the-correct-parameters - Y Sent from a device with a very small keyboard and hyperactive autocorrect. On Fri, Feb 6, 2026, 4:13=E2=80=AFPM Knute Johnson <[email protected]= > wrote: > I'm thinking of putting them all on the naughty list. Any reason I > shouldn't? > > Thanks, > > Knute... > > On 2/6/26 14:42, Yehuda Katz wrote: > > HTTP 408 means the client opened a connection but didn't send a request= . > > This could be caused by anything from a misconfigured or buggy program > > on the client side, to a malicious actor trying to overwhelm your serve= r > > with fake connections. > > > > - Y > > > > Sent from a device with a very small keyboard and hyperactive > autocorrect. > > > > On Fri, Feb 6, 2026, 3:18=E2=80=AFPM Knute Johnson <groups@knutejohnson= .com > > <mailto:[email protected]>> wrote: > > > > From my access.log > > > > 181.215.169.144 - - [06/Feb/2026:20:10:38 +0000] "-" 408 7240 "-" "= -" > > 194.180.179.107 - - [06/Feb/2026:20:10:47 +0000] "-" 408 7240 "-" "= -" > > 194.180.179.107 - - [06/Feb/2026:20:10:47 +0000] "-" 408 7240 "-" "= -" > > 194.180.179.107 - - [06/Feb/2026:20:10:47 +0000] "-" 408 7240 "-" "= -" > > > > > > -- > > > > Knute Johnson > > [email protected] <mailto:[email protected]> > > > > > > -------------------------------------------------------------------= -- > > To unsubscribe, e-mail: [email protected] > > <mailto:[email protected]> > > For additional commands, e-mail: [email protected] > > <mailto:[email protected]> > > > > > -- > > Knute Johnson > [email protected] > > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > > --000000000000537003064a2e5f8c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <div dir=3D"auto"><div>I recommend fail2ban to set a block after some numbe= r of 408s for a single IP. There are a lot of forum/QA posts about this spe= cific filter - example: <a href=3D"https://security.stackexchange.com/quest= ions/155941/blocking-slowloris-using-fail2ban-what-are-the-correct-paramete= rs">https://security.stackexchange.com/questions/155941/blocking-slowloris-= using-fail2ban-what-are-the-correct-parameters</a></div><div dir=3D"auto"><= br></div><div dir=3D"auto">- Y</div><div><br></div><div data-smartmail=3D"g= mail_signature">Sent from a device with a very small keyboard and hyperacti= ve autocorrect.</div></div><br><div class=3D"gmail_quote gmail_quote_contai= ner"><div dir=3D"ltr" class=3D"gmail_attr">On Fri, Feb 6, 2026, 4:13=E2=80= =AFPM Knute Johnson <<a href=3D"mailto:[email protected]">groups@k= nutejohnson.com</a>> wrote:<br></div><blockquote class=3D"gmail_quote" s= tyle=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);pad= ding-left:1ex">I'm thinking of putting them all on the naughty list.=C2= =A0 Any reason I <br> shouldn't?<br> <br> Thanks,<br> <br> Knute...<br> <br> On 2/6/26 14:42, Yehuda Katz wrote:<br> > HTTP 408 means the client opened a connection but didn't send a re= quest. <br> > This could be caused by anything from a misconfigured or buggy program= <br> > on the client side, to a malicious actor trying to overwhelm your serv= er <br> > with fake connections.<br> > <br> > - Y<br> > <br> > Sent from a device with a very small keyboard and hyperactive autocorr= ect.<br> > <br> > On Fri, Feb 6, 2026, 3:18=E2=80=AFPM Knute Johnson <<a href=3D"mail= to:[email protected]" target=3D"_blank" rel=3D"noreferrer">groups@knu= tejohnson.com</a> <br> > <mailto:<a href=3D"mailto:[email protected]" target=3D"_blank= " rel=3D"noreferrer">[email protected]</a>>> wrote:<br> > <br> >=C2=A0 =C2=A0 =C2=A0 =C2=A0From my access.log<br> > <br> >=C2=A0 =C2=A0 =C2=A0181.215.169.144 - - [06/Feb/2026:20:10:38 +0000] &q= uot;-" 408 7240 "-" "-"<br> >=C2=A0 =C2=A0 =C2=A0194.180.179.107 - - [06/Feb/2026:20:10:47 +0000] &q= uot;-" 408 7240 "-" "-"<br> >=C2=A0 =C2=A0 =C2=A0194.180.179.107 - - [06/Feb/2026:20:10:47 +0000] &q= uot;-" 408 7240 "-" "-"<br> >=C2=A0 =C2=A0 =C2=A0194.180.179.107 - - [06/Feb/2026:20:10:47 +0000] &q= uot;-" 408 7240 "-" "-"<br> > <br> > <br> >=C2=A0 =C2=A0 =C2=A0-- <br> > <br> >=C2=A0 =C2=A0 =C2=A0Knute Johnson<br> >=C2=A0 =C2=A0 =C2=A0<a href=3D"mailto:[email protected]" target= =3D"_blank" rel=3D"noreferrer">[email protected]</a> <mailto:<a hr= ef=3D"mailto:[email protected]" target=3D"_blank" rel=3D"noreferrer">= [email protected]</a>><br> > <br> > <br> >=C2=A0 =C2=A0 =C2=A0---------------------------------------------------= ------------------<br> >=C2=A0 =C2=A0 =C2=A0To unsubscribe, e-mail: <a href=3D"mailto:users-uns= [email protected]" target=3D"_blank" rel=3D"noreferrer">users-unsub= [email protected]</a><br> >=C2=A0 =C2=A0 =C2=A0<mailto:<a href=3D"mailto:users-unsubscribe@http= d.apache.org" target=3D"_blank" rel=3D"noreferrer">users-unsubscribe@httpd.= apache.org</a>><br> >=C2=A0 =C2=A0 =C2=A0For additional commands, e-mail: <a href=3D"mailto:= [email protected]" target=3D"_blank" rel=3D"noreferrer">users-hel= [email protected]</a><br> >=C2=A0 =C2=A0 =C2=A0<mailto:<a href=3D"mailto:[email protected]= e.org" target=3D"_blank" rel=3D"noreferrer">[email protected]</a>= ><br> > <br> <br> <br> -- <br> <br> Knute Johnson<br> <a href=3D"mailto:[email protected]" target=3D"_blank" rel=3D"norefer= rer">[email protected]</a><br> <br> <br> ---------------------------------------------------------------------<br> To unsubscribe, e-mail: <a href=3D"mailto:[email protected]= g" target=3D"_blank" rel=3D"noreferrer">[email protected]<= /a><br> For additional commands, e-mail: <a href=3D"mailto:[email protected].= org" target=3D"_blank" rel=3D"noreferrer">[email protected]</a><b= r> <br> </blockquote></div> --000000000000537003064a2e5f8c--