Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

In my logs I keep getting lots of:

"CONNECT XXX.XXX.XXX.XXX:443 HTTP/1.0" 404 218 "-" "-"
"CONNECT XXX.XXX.XXX.XXX:443 HTTP/1.0" 404 218 "-" "-"
"CONNECT XXX.XXX.XXX.XXX:443 HTTP/1.0" 404 218 "-" "-"

Is this some specific vulnerability?

share|improve this question

2 Answers 2

up vote 2 down vote accepted

HTTP CONNECT is used for tunnelling. Apache supports this through the use of mod_proxy_connect.

A badly configured proxy with support for CONNECT may be a security vulnerability, so if you don't need it you should disable it.

I'm not sure how Apache responds to a CONNECT request if these aren't enabled, but a 404 seems unlikely; I would rather expect a 405 or 501. As such, you should probably check your configuration.

share|improve this answer
+1 This is a more succinct answer than mine. In my test (albeit telnet) example, it indeed reports 400 / Bad Request. Perhaps the 404 implies it wasn't tunneling but requesting a specific resource? – msanford Aug 30 '12 at 19:08

It's likely an attempt to use your server as a proxy, possibly from a bot-net virus or script-kiddie. Specifically, though, it's (possibly) someone telnetting into your box, like so:

$ telnet localhost 80
Trying ::1...
Connected to localhost.
Escape character is '^]'.

HTTP/1.1 400 Bad Request
Connection: close
Content-Type: text/html; charset=iso-8859-1
[more header data ... ]
<html ... />

Are you running a mail server on that box? Do you, by any chance, have firewall logs indicating repeated connections or connection attempts to port 25?

These two articles detail two troubleshooting cases of this same problem:

Combined, they offer several fixes (which I'll summarize for posterity, but you should read the whole threads for context):

  1. Limit CONNECT in httpd.conf with <Limit CONNECT>Deny from all</Limit>
  2. Disable mod_proxy if you're not using it.

Be on the lookout for lines that don't return 404 / 400 (in particular, 200), because that might indicate they successfully accessed some resource, which in itself is not necessarily troubling.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.