Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are getting this kind of HTTP header:

Accept-Language: fr-CH,x-ns1Ci7OslejNxN,x-ns2af6MxcVGQb2

Can anyone help me knowing where does it come from. It's just by curiosity that I'm asking this. Searching around, I suspect a Squid proxy but I'd love having a full explanation.

share|improve this question
Please provide the full HTTP headers for one of these requests - it might then be possible to see what's going on. – RichVel Mar 21 '12 at 6:53
@RichVel Right! I'll start logging all of them. – greut Mar 21 '12 at 7:55

Looks odd, it might be that this is a hack attempt, similar to this one - however you'd need to provide more log information. Worth looking at your logs, and checking the web apps you have on that server for any vulnerabilities in this area.

share|improve this answer
These requests seem legit: User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) and the cookie contains some Google Analytics (__utm*) stuff too. Other browsers do that too (Firefox, …) – greut Mar 20 '12 at 7:54
A link I just found on how these kind of breach can be used:… – greut Mar 20 '12 at 10:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.