1

We are getting this kind of HTTP header:

Accept-Language: fr-CH,x-ns1Ci7OslejNxN,x-ns2af6MxcVGQb2

Can anyone help me knowing where does it come from. It's just by curiosity that I'm asking this. Searching around, I suspect a Squid proxy but I'd love having a full explanation.

2
  • Please provide the full HTTP headers for one of these requests - it might then be possible to see what's going on.
    – RichVel
    Mar 21, 2012 at 6:53
  • @RichVel Right! I'll start logging all of them.
    – greut
    Mar 21, 2012 at 7:55

1 Answer 1

0

Looks odd, it might be that this is a hack attempt, similar to this one - however you'd need to provide more log information. Worth looking at your logs, and checking the web apps you have on that server for any vulnerabilities in this area.

2
  • These requests seem legit: User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) and the cookie contains some Google Analytics (__utm*) stuff too. Other browsers do that too (Firefox, …)
    – greut
    Mar 20, 2012 at 7:54
  • A link I just found on how these kind of breach can be used: programmingpanda.blogspot.com/2009/08/…
    – greut
    Mar 20, 2012 at 10:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .