More Apache Log Errors!

Crashed_Again · 02-26-2003, 02:51 PM

What exactly are these two requests trying to accomplish:

www.isecom.com.ar - - [26/Feb/2003:15:46:36 -0500] "POST http://200.69.212.165:6667/ HTTP/1.0" 200 613 "-" "-"
www.isecom.com.ar - - [26/Feb/2003:15:46:36 -0500] "CONNECT 200.69.212.165:6667 HTTP/1.0" 405 316 "-" "-"

The ip address 200.69.212.165 is not related to my network at all and as for port 6667 I have no idea what that is all about.

nxny · 02-26-2003, 08:01 PM

6667 is the IRC port, if I remember right. Do you get these a lot? I have a vague idea that someone is trying to 'post' to the IRC server at the 200.x.x.x ip via your httpd. Now, that's just PURE speculation, cuz I dont know how successful these attempts would be if they were real . We'll have to see the whole packet (tcpdump) when this happens to make sure what my guess isn't too far fetched.

Scrapz · 02-27-2003, 05:21 AM

Some IRC servers do a sort of port scan on connect. If you look closely at the MOTD when you connect to the server, you might find something similar to this:

Quote:

--- - Please be aware that OFTC operates an open proxy detection
--- - system(http://www.blitzed.org/bopm). Please disregard
--- - connections from proxy-scan.oftc.net(216.86.139.17) as it
--- - is the detector in action. If you dislike this, please
--- - disconnect now.

Anything on port 6667 will most likely be the IRC proxy scans. Its nothing to be worried about, unless of course, you're not using IRC