I keep seeing this HTTP header in the blocked HTTP requests on my web server for a lot of separate applications:


Which is in Portuguese, and it means: Connection: closed

This header contains a an Illegal character by the RFC, this is why it is blocked.

All of these requests look the same:

GET /   HTTP/1.1
Accept: text/html 
Cache-Control: no-cache 
Proxy-Connection: Keep-Alive 
User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows NT)                   
Pragma: no-cache 
Cache-Control: no-cache 
**Conexo: fechada**  
Host: xxxxxxxxxxxxxxxxxxxxxx

The thing these are coming from multiple source IPs, and coming to many non related web applications...

migrated from security.stackexchange.com Aug 3 '11 at 9:00

This question came from our site for information security professionals.

  • 2
    This is funny! Looks like someone went a bit too far with localizing strings in software :). What are the other associated headers? It would be easier to figure out which application it is if you posted all the headers in that request. – snap Aug 3 '11 at 9:17
  • 1
    My guess is that it is a spambot or similar... thus better to filter it than let it through. The User-Agent does not look like anyone friendly (not a genuine browser and not a friendly bot either). BTW, you probably should not post additional information as answers. When you need to add something, either put it in comments or edit the original question. – snap Aug 3 '11 at 9:51
  • Probably some kind of a bot, because I am not getting complains about from blocked users. Thanks for the tip. – user90329 Aug 3 '11 at 10:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy