RetroFed Forums
Your home away from modern life.
Search Categories Forum list Register Log in
About RetroFed
RetroFed

Welcome to the nostalgia-filled piefed instance of yesteryear.

Open Registration with Application questionnaire.

If you have a question or comment you can post in !meta@retrofed.com or message @DosDude@retrofed.com or @Die4Ever@retrofed.com

In case of downtime and/or emergency, we will post updates on @DosDude@mastodon.social

Some rules we try to uphold:

  • Be civil. Bigotry is not welcome. This includes (but is not limited to): transphobia, queerphobia, racism, ageism and ableism. We do not promote hate.
  • Communities need to be Retro or Retro-adjacent.
  • Please don't upload pornographic content. (use an external image host for that)
72 registered users
Administrators: DosDude, Die4Ever
Visit retrofed.com
Is this come kind of hack attempt?
Post Reply RetroFed Forums Forum Index » Security Operations
AuthorMessage
lettruthout
lemmy.world
lettruthout@lemmy.world
Joined: 2023-06-11
Posted:   Subject: Is this come kind of hack attempt? Quote

The NGINX access.log of my VPS is showing a curiosity.

Instead of a simple request like this...

"GET / HTTP/1.1"

...regular requests are coming in that look like this

"\x03\x00\x00\x13\x0E\xE0\x00\x00\x00\x00\x00\x01\x00\x08\x00\x03\x00\x00\x00"

Is this some kind of hack attempt?

Here's an example of a full line from the log...

15.204.204.182 - - [24/Apr/2024:15:59:47 +0000] "\x03\x00\x00\x13\x0E\xE0\x00\x00\x00\x00\x00\x01\x00\x08\x00\x03\x00\x00\x00" 400 166 "-" "-"

EDIT: For what it might be worth, most of these requests come in singularly, from different IP addresses. Once (that I've noticed) repeated attempts came in quickly from one specific IP.
1   Original
Post Reply Page 1
Powered by RetroFed · PieBB frontend · All times are Europe/Amsterdam