[Gllug] What's going on?

[Jason Clifford]

On Tue, 19 Nov 2002, Adrian McMenamin wrote:

> An entry like this has appeared twice in my apache server log in the last 24
> hours:
> 
> pool-141-150-114-101.mad.east.verizon.net - - [18/Nov/2002:08:26:41 +0000]
> "CONNECT mx00.earthlink.net:25 HTTP/1.0" 405 302 "-" "-"
> 
> Earthlink say it is nothing to be concerned about (no reply from verizon) -
> but it looks very odd to me - why is someone trying to get our web server to
> attach themselves to their mail server?

Indeed. This is a favoured tactic of many spammers.

Web proxies that are accessable to the outside world can be used to relay 
spam to mail servers in such a manner as to completely hide the chain of 
previous relays making it look like your server was the point of origin.

I do wonder why you are running a public web proxy. Do you really need to?

If not set up your acls properly.

Jason Clifford
-- 
UKFSN.ORG		Finance Free Software while you surf the 'net
http://www.ukfsn.org/			Sign Up Now
UKPOST.COM	 	           get your @ukpost.com address now...
http://www.ukpost.com/	 	   professional hosting and colocation


-- 
Gllug mailing list  -  Gllug at linux.co.uk
http://list.ftech.net/mailman/listinfo/gllug