webserver logs

Post by **signa** » Fri Feb 18, 2005 2:34 am

for those of you who run webservers, Im used to seeing various hax attempts on my apache server, but this is a new one. any ideas what this is?

61.31.159.178 - - [17/Feb/2005:12:17:52 -0500] "CONNECT ms8.hinet.net:25 HTTP/1.0" 200 941

seems to be alot of "connect" attempts. especially from that dynamic.tfn.net.tw domain. I think port 25 is for mail, but im not running a mail server.

Post by **Seg** » Fri Feb 18, 2005 4:05 am

Check your etc/services file and see what's defined to 25. I think it's smtp though. As long as you aren't running a smtp server then it's not a problem.

Post by **Underpants?** » Fri Feb 18, 2005 3:13 pm

wow. the only thing that comes to mind is someone's probing for a james server, a mail app which runs over apache on port 25. That's a strange one, there're no nerds bitching about this on any of my security lists.