Print view Previous topic | Next topic

Topic Starter	Topic: webserver logs
signa no u Joined: 15 Sep 2004 Posts: 150	Posted: 02-17-2005 06:34 PM                  for those of you who run webservers, Im used to seeing various hax attempts on my apache server, but this is a new one. any ideas what this is? 61.31.159.178 - - [17/Feb/2005:12:17:52 -0500] "CONNECT ms8.hinet.net:25 HTTP/1.0" 200 941 seems to be alot of "connect" attempts. especially from that dynamic.tfn.net.tw domain. I think port 25 is for mail, but im not running a mail server.
Top

Seg Immortal Joined: 28 Jun 2000 Posts: 2804	Posted: 02-17-2005 08:05 PM                  Check your etc/services file and see what's defined to 25. I think it's smtp though. As long as you aren't running a smtp server then it's not a problem.
Top

Underpants? Elite Joined: 21 Oct 2001 Posts: 6519	Posted: 02-18-2005 07:13 AM                  wow. the only thing that comes to mind is someone's probing for a james server, a mail app which runs over apache on port 25. That's a strange one, there're no nerds bitching about this on any of my security lists.
Top

Quake3World.com | Forum Index | Technology & Troubleshooting