RE: Strange apache logs: CONNECT maila.microsoft.com:25

From: Andy Coates <andy(at)bribed.net>
Date: Fri Nov 22 2002 - 07:10:39 EST

> Hello,
That's usually what gets logged when a proxy attempt is made. Someone is either trying to spam someone at microsoft by hiding their source ip using your web server as a proxy, or is just testing to see whether you are an "open proxy" - which is normally recorded for later use.

If you don't run any proxy software (squid etc) and its just apache, nothing to worry about really.

I doubt they're targetting you specifically, more likely a complete network scan if they are repeating the same request day after day.

HTH,
Andy.

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Mon Nov 25 11:26:10 2002