Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Running apache on a debian server, I have been starting to monitor logs, and have found some odd occurrences. Does anyone know what this site is trying to do... and how can I block this potentially malicious traffic?

Sanitized logs:

[] - [13/Apr/2011:13:02:09 -0700] | "POST HTTP/1.1" 404 294 | -
[] - [15/Apr/2011:13:02:53 -0700] | "POST HTTP/1.1" 404 294 | -
[] - [17/Apr/2011:13:05:04 -0700] | "POST HTTP/1.1" 404 294 | -

Where 404 is the error code and 294 is the size of the response.


Did a packet capture, and this was the request I got:

Pragma: no-cache
Accept: */*
Proxy-Connection: Keep-Alive
Cookie: strCookie=cookie2566
Content-Length: 16
Content-Type: application/x-www-form-urlencoded

share|improve this question
up vote 5 down vote accepted

This looks like internet background noise. A dodgy or compromised host is probably port scanning for open web servers and then testing them out to see if they'll relay a POST to a 3rd party site. Your server is naturally 404ing the request. It's likely not targeted at you and the chances are it will stop, pretty soon.

That said, the timing is unusually regular for this sort of traffic, so if it doesn't stop, the source of the request is If you block anything, then block that host at the firewall. (via iptables)

share|improve this answer

You can use iptables to block this request. That is a post request so not sure what data is being sent with it. Can try running tcpdump to get that info.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.