Strange Apache log

esaym · 01-04-2007, 12:11 AM

I just had this show up in my apache log. What the heck does it mean? Not an ip address I know of..

82.96.96.3 - - [03/Jan/2007:08:19:48 -0600] "POST http://82.96.96.3:802/ HTTP/1.0" 200 2718 "-" "-"
82.96.96.3 - - [03/Jan/2007:08:19:48 -0600] "CONNECT 82.96.96.3:802 HTTP/1.0" 405 322 "-" "-"

82.96.96.3 - - [03/Jan/2007:22:08:40 -0600] "CONNECT 82.96.96.3:802 HTTP/1.0" 405 322 "-" "-"
82.96.96.3 - - [03/Jan/2007:22:08:41 -0600] "POST http://82.96.96.3:802/ HTTP/1.0" 200 2718 "-" "-"

It really sticks out from all the usual "GET" connections...

gilead · 01-04-2007, 05:05 AM

It looks like some from 82.96.96.3 (a German IP address, according to ripe) was checking whether they could use your server to connect back to their own server on port 802 - the 200 code says that the POST did work. The 405 response for the CONNECT means that your server didn't allow that method to be used.

esaym · 01-04-2007, 09:59 AM

Quote:

Originally Posted by gilead

It looks like some from 82.96.96.3 (a German IP address, according to ripe) was checking whether they could use your server to connect back to their own server on port 802 - the 200 code says that the POST did work. The 405 response for the CONNECT means that you server didn't allow that method to be used.

hmm interesting. Thanks

esaym · 01-04-2007, 12:25 PM

Ok I did some reading on that ip address and it looks like it is normal if you use irc

Capt_Caveman · 01-04-2007, 09:09 PM

Interesting, I hadn't seen that before. Just to clarify for those lurking in this thread or who come across it via a google search, if you do a whois of the scanning ip (82.96.96.3), you'll see this message:

Quote:

"remarks: If you see portscans/abuse from 82.96.96.3
remarks: Please read http://freenode.net/policy.shtml#proxies"

If you follow that link, you'll see:

Quote:

Open Proxies, IIS and Appeals
Like many interactive networks, we've had our share of problems with denial-of-service attacks. As a result, we've had to develop a variety of measures to reduce the impact of such attacks. freenode may block access to users whose IRC clients run on hosts with open proxies, IIS servers or other categories of software determined to present special risk to our server environment. We reserve the right to use automation to attempt to detect such software on your host, as you connect to our servers, while you remain connected to the network and on occasion during post-connection analysis. Your use of the network signifies your acceptance.

It's still be a good idea to correlate the time the scan was received with your IRC activity, just to be on the safe side. Thanks for posting this.

gloomy · 01-07-2007, 01:52 AM

Thank you Capt_Caveman for your eagle eyes. As a daily user of the Freenode network, the 82.96.96.3 indeed have popped up in my webserver logs. However, I have long time ago blocked the whole Probe Networks subnet with no effect in the irc usage of that network.

I also doubt how effective such a measure can be in DoS prevention.

Capt_Caveman · 01-07-2007, 10:29 AM

You can thank esaym, I was just expanding on what he posted to make it a bit more clear what was going on.