[Techtalk] Apache, abuse and nonexistent domains.

[k.clair]

Hmm, I'm confused --

if the request made it to the apache log, it must have connected on port
80.  but the request was supposed to go to port 25?

or is this something that is trying to get apache to connect to port 25
on 203.190.194.95?

dizzily,
kristina

On Wed, Dec 18, 2002 at 01:57:09AM +0000, Michelle Konzack wrote:
- Hallo Therese,
- 
- Am 01:41 2002-12-17 -0800 hat Therese Gustafsson geschrieben:
-  >
-  >Hi everyone.
-  >
-  >Lately I have a lot of logentries in my Apache access_log like this:
-  >208.3.113.49 - - [17/Dec/2002:04:34:42 +0100] "CONNECT
-  >203.190.194.95:25 HTTP/1.1" 400 379 "-" "-"
- 
- Port 25 is smtp !!!
- 
- Ther is someon, which like to use your Web-Server as OPEN
- SMTP-RELAY...
- 
- Somtimes you find misconfigured Webservers which use a MUA
- for sending error-messages. and if the Admin forget to deny
- relaying, the Webserver can be used to spamm...
- 
- If you have a MUA installed on the web server, please check
- the config !!!
- 
- IF not, disable the smtp service.
- 
- Michelle
- 
- _______________________________________________
- Techtalk mailing list
- Techtalk at linuxchix.org
- http://mailman.linuxchix.org/mailman/listinfo/techtalk

### my gpg key can be found here:
http://www.klerp.net/gpgkey