Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

in my previous post I got something weird in Apache log. Again, I found something strange, but what freaks me out is the response code. It's not 501 anymore, but 200. What do you say? Should I enable the paranoid-mode? Here's the entry:

***.***.***.*** - - [02/Feb/2011:00:42:51 +0100] "=\xa29)\x84\x11\xd0O\xa7@\xbd\x8f\xc4G\x96T\xf4" 200 25564
share|improve this question

It wasn't a valid HTTP-request. You could get similar log entry doing something like telnet youserver 80 and then Entering 'HELLO'. I guess there's some index.php at the root of your server?

share|improve this answer
That's right. There's an index.php in /. – aL3xa Feb 2 '11 at 11:14
So, it simply runs it as the default handler of the request. N0t4h4ck. ) – poige Feb 2 '11 at 11:47
Well, the IP originates from Ukraine. That's odd. =/ – aL3xa Feb 2 '11 at 19:19
It's not odd, it's Interneted too. – poige Feb 3 '11 at 1:19

If memory serves 200 is a HTTP Status code for OK

From wikipedia

2xx Success

This class of status codes indicates the action requested by the client was received, understood, accepted and processed successfully.

200 OK Standard response for successful HTTP requests. The actual response will depend on the request method used. In a GET request, the response will contain an entity corresponding to the requested resource. In a POST request the response will contain an entity describing or containing the result of the action.

share|improve this answer
Yes, 200 = OK, but doesn't that mean that potentially malicious request is executed on my server? – aL3xa Feb 2 '11 at 1:07
I would think that this appearing in the log could be a simple misformed packet... as they do happen i dont often read my log files as close as you seem to :) (good on you tho for keep such a close eye on it) as an answer on your last post said if it woudl be more than likely that if this was a hacker that found a hole you would of been hacked well before you saw the log file. - I will however look around and see what i can find for you :) – Trozz Feb 2 '11 at 1:10
have a look it appears to be common place for a 200 in the logs, ill have a look at my apache server once i have a chance tomorrow – Trozz Feb 2 '11 at 1:12
I'll do that, thanx for info! – aL3xa Feb 2 '11 at 1:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.