Checked your proxy lately?

Colin McKinnon <colin.mckinnon-XZoyATsUNX5Wk0Htik3J/[email protected]>
Newsgroups gmane.user-groups.linux.scottish
Message-ID <[email protected]>
Hi all,

While I'm sure you've all got your systems setup securely, I've noticed that 
recently there is more noise in my logs from HTTP proxy requests than I get 
for ssh attacks. AFAIK, I'm not running an open proxy. 

The origin of these requests are primarily China. Do I nned to spell out the 
risks here?

It may be worth having a wee check of your logs/configs?

92.240.68.153 - - [07/Jan/2011:12:58:09 +0000] "GET 
http://japanese.engadget.com/media/2007/10/apple_sony_cybershot_t2.jpg 
HTTP/1.1" 404 
325 "http://www.altavista.com/image/randomlink" "webcollage/1.135a" - 1155 
kermit.southwold.net "text/html"

58.218.204.110 - - [07/Jan/2011:16:16:02 +0000] "GET 
http://www.foodnese.com/indux.php HTTP/1.1" 404 288 "-" "Mozilla/4.0 
(compatible; MSIE 6.0; Windows NT 5.1)" - 763 
kermit.southwold.net "text/html"

58.218.199.147 - - [07/Jan/2011:20:00:23 +0000] "GET http://173.201.161.57/ 
HTTP/1.1" 200 26 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" - 
14391 kermit.southwold.net "text/html"

58.218.199.147 - - [07/Jan/2011:22:25:08 +0000] "GET 
http://98.126.15.13/proxyheader.php HTTP/1.1" 404 290 "-" "Mozilla/4.0 
(compatible; MSIE 6.0; Windows NT 5.1)" - 1120 
kermit.southwold.net "text/html"
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.