From owner-freebsd-questions  Sat Sep 14 19:35:38 2002
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.FreeBSD.org (mx1.FreeBSD.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id CA71637B400
	for <questions@freebsd.org>; Sat, 14 Sep 2002 19:35:36 -0700 (PDT)
Received: from bara.naviservers.net (bara.naviservers.net [216.242.137.9])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 4443243E6A
	for <questions@freebsd.org>; Sat, 14 Sep 2002 19:35:36 -0700 (PDT)
	(envelope-from root@bara.naviservers.net)
Received: from localhost (root@localhost)
	by bara.naviservers.net (8.11.6/8.9.3) with ESMTP id g8F2XLR92175
	for <questions@freebsd.org>; Sun, 15 Sep 2002 11:33:21 +0900 (JST)
	(envelope-from root@bara.naviservers.net)
Date: Sun, 15 Sep 2002 11:33:21 +0900 (JST)
From: Roger Williams <root@bara.naviservers.net>
To: <questions@freebsd.org>
Subject: Off Topic: New Apache Attack??
Message-ID: <20020915113245.N92173-100000@bara.naviservers.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

Hello Group,
  Ever since 9/13 I have been getting the following "attack" on some of my
webservers:


<snip>
(www.chance7.com) 213.77.18.2 - - [15/Sep/2002:10:47:19 +0900] "-" 408 -
"-" "-"
(www.ecnet.nu) 213.77.18.2 - - [15/Sep/2002:10:47:19 +0900] "-" 408 - "-"
"-"
(www.hanabu.net) 213.77.18.2 - - [15/Sep/2002:10:47:19 +0900] "-" 408 -
"-" "-"
(www.neo-nate.net) 213.77.18.2 - - [15/Sep/2002:10:47:20 +0900] "-" 408 -
"-" "-"
(www.armbalance.jp) 213.77.18.2 - - [15/Sep/2002:10:47:20 +0900] "-" 408 -
"-" "-"
(www.pure-garden.com) 213.77.18.2 - - [15/Sep/2002:10:47:20 +0900] "-" 408
- "-" "-"
(www.web-palette.org) 213.77.18.2 - - [15/Sep/2002:10:47:20 +0900] "-" 408
- "-" "-"
(www.johosite.com) 213.77.18.2 - - [15/Sep/2002:10:47:20 +0900] "-" 408 -
"-" "-"
(www.futcom.jp) 213.77.18.2 - - [15/Sep/2002:10:47:20 +0900] "-" 408 - "-"
"-"
(www.syu-ho.com) 213.77.18.2 - - [15/Sep/2002:10:47:20 +0900] "-" 408 -
"-" "-"
(www.soulbarglum.com) 213.77.18.2 - - [15/Sep/2002:10:47:20 +0900] "-" 408
- "-" "-"
(www.jikoyobou.info) 213.77.18.2 - - [15/Sep/2002:10:47:20 +0900] "-" 408
- "-" "-"
</snip>

Is anyone else experiencing it? Or seen it before?  They are bringing down
the servers. They come from all over the world not just one place.

Thanks,
Roger


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message