Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I found this in my logs earlier today: - - [17/Feb/2013:17:39:49 -0900] "k\x8a4\x8f\x9f\x1c\xfb\xb9\xf4\xb8\x97CI\xa3w\xeb\xf9\xb2\xb4\b\xb9\x04\x05\xe1M\x88C\xde\xed<\x13\b\xfd\b\x9d\xb047\xe5k\x87\r\xc6\x1a\xab\x16b" 400 301 "-" "-"

Also this from the error log (same request):

[Sun Feb 17 17:39:49 2013] [error] [client] Invalid URI in request k\x8a4\x8f\x9f\x1c\xfb\xb9\xf4\xb8\x97CI\xa3w\xeb\xf9\xb2\xb4\b\xb9\x04\x05\xe1M\x88C\xde\xed<\x13\b\xfd\b\x9d\xb047\xe5k\x87\r\xc6\x1a\xab\x16b

Does anyone know what that means? I think its some kind of hex code or something but just was interested because I get one of these every few days or so, and also if it was potentially dangerous.

share|improve this question
That could be shellcode (i.e., an attack on the server). Update, check security measures. – vonbrand Feb 19 '13 at 3:47
up vote 2 down vote accepted

They are non-printable characters in the HTTP request. It could be someone trying to exploit your server or as harmless as a request containing multi-byte unicode characters.

The Apache mod_log_config manual explains the format:

For security reasons, starting with version 2.0.46, non-printable and other special characters in %r, %i and %o are escaped using \xhh sequences, where hh stands for the hexadecimal representation of the raw byte.

share|improve this answer
Ah thanks that makes more sense now. – user160606 Feb 19 '13 at 5:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.