What does '0U' mean in apache's error-log?

Question

Recently, in my apache's error-log, I found a lot of lines like this:

[Mon Sep 12 12:34:56 2011] [error] [client ***.***.***.***] 0U, referer: http://www.***.com/

"www.*.com" is my domain name. What does '0U' mean? Responses' code corresponding to the some of the error requests are 416. My apache's version is 2.2.14.

PS: I use apache+mod_jk+tomcat6 to build my website.The apache is the front end server, so there is no cgi or php module.

2011-09-12 12:34:56 218.85.19.63 "GET /site/public/stylesheets/i.css HTTP/1.1" 550 416 687 590 "9e.cn/"; "Mozilla/5.0 (Wi ndows; U; Windows NT 5.1; ) AppleWebKit/534.12 (KHTML, like Gecko) Maxthon/3.0 Safari/534.12

is the corresponding access log. Note that the 416 is the http response code. But not all the error requests corresponding response code is 416. Access log's format is "%{%Y-%m-%d %H:%M:%S}t %h \"%r\" %q %D %>s %I %O \"%{Referer}i\" \"%{User-Agent}i\".

Answer 1

My guess would be that someone is trying to do this to you but hasn't quite got the value of the Range: header right yet.

The 0U, is probably supposed to be just 0, which would be part of a valid range in the Range: header of an HTTP request. The log entries where the response code was not 416 is probably where the attacker didn't even get the header correct and are probably 400 response codes.

The reason I expect it shows up in the error logs is that it is the part of the request that cause the error. In a 404 error, the URI is what shows up in that field.

Another couple of hints that this is probably an attacker is the IP address in China (I hate to generalise but I do see a lot of attack traffic from China) and a strange looking referrer. I would not recommend loading that referrer up in your regular web browser.