Re: What is this request looking for?

On Fri 06/Feb/2026 21:42:11 +0100 Yehuda Katz wrote:
> HTTP 408 means the client opened a connection but didn't send a request.
> This could be caused by anything from a misconfigured or buggy program on 
> the client side, to a malicious actor trying to overwhelm your server with 
> fake connections.


Yesterday, I had 255,769 connections to port 443, while access.log only had 
3,798 lines.  So, something was up for 408, albeit not a complete request. 
access.log had 9 lines with a 408 error.  Five of these appear to be real users 
accessing a page along with its images/CSS, using AppleWebKit.  The 408 error 
appeared a few moments after the last request.  Perhaps something to keep the 
connection alive?


> On Fri, Feb 6, 2026, 3:18 PM Knute Johnson <[email protected]> wrote:
>
>>  From my access.log
>>
>> 181.215.169.144 - - [06/Feb/2026:20:10:38 +0000] "-" 408 7240 "-" "-"
>> 194.180.179.107 - - [06/Feb/2026:20:10:47 +0000] "-" 408 7240 "-" "-"
>> 194.180.179.107 - - [06/Feb/2026:20:10:47 +0000] "-" 408 7240 "-" "-"
>> 194.180.179.107 - - [06/Feb/2026:20:10:47 +0000] "-" 408 7240 "-" "-"


FWIW, the first IP wasn't found on AbuseIPDB.  Se second only has a few reports 
from a month ago.


Best
Ale
--