Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are getting this kind of HTTP header:

Accept-Language: fr-CH,x-ns1Ci7OslejNxN,x-ns2af6MxcVGQb2

Can anyone help me knowing where does it come from. It's just by curiosity that I'm asking this. Searching around, I suspect a Squid proxy but I'd love having a full explanation.

share|improve this question
    
Please provide the full HTTP headers for one of these requests - it might then be possible to see what's going on. –  RichVel Mar 21 '12 at 6:53
    
@RichVel Right! I'll start logging all of them. –  greut Mar 21 '12 at 7:55
add comment

1 Answer

Looks odd, it might be that this is a hack attempt, similar to this one - however you'd need to provide more log information. Worth looking at your logs, and checking the web apps you have on that server for any vulnerabilities in this area.

share|improve this answer
    
These requests seem legit: User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) and the cookie contains some Google Analytics (__utm*) stuff too. Other browsers do that too (Firefox, …) –  greut Mar 20 '12 at 7:54
    
A link I just found on how these kind of breach can be used: programmingpanda.blogspot.com/2009/08/… –  greut Mar 20 '12 at 10:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.