I keep seeing this HTTP header in the blocked HTTP requests on my web server for a lot of separate applications:
Which is in Portuguese, and it means: Connection: closed
This header contains a an Illegal character by the RFC, this is why it is blocked.
All of these requests look the same:
GET / HTTP/1.1 Accept: text/html Cache-Control: no-cache Proxy-Connection: Keep-Alive User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT) Pragma: no-cache Cache-Control: no-cache **Conexo: fechada** Host: xxxxxxxxxxxxxxxxxxxxxx
The thing these are coming from multiple source IPs, and coming to many non related web applications...