32

I notice from my server logs that there have been a number of requests like

[01/Jun/2016:07:47:58 +0000] "\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01" 400 181 "-" "-"

Should I be concerned about such requests, if so what should I do about them ?

3
  • 1
    This is the same question as on serverfault. I recommend checking here.
    – Bomskie
    Jun 1, 2016 at 10:15
  • @Bomskie I think that question should be migrated here, since this is IS, and that question is in SF. It might help to bring this here, as to not flood SF up.
    – EKons
    Jun 1, 2016 at 13:34
  • 2
    @ΈρικΚωνσταντόπουλος General policy when a question is on-topic on multiple sites is to leave them alone unless the OP specifically asks for a migration. (Unless asked by the same person, in which case it's cross-posting and generally bad.)
    – Bob
    Jun 2, 2016 at 2:48

1 Answer 1

36

These kinds of requests are commonly used for server fingerprinting. By sending a request that is likely to trigger an error other than a common 403, 404, 500, etc. they hope that the site operator did not set a custom error page, and that it will return a default error page with server type and version information. You'll often see really long URLs used to force a HTTP 414 response for the same reason.

As to whether it's malicious; it's probably an automated bot rather than a targeted attack. What they do after scanning is what determines whether it's malicious or not. A lot of the time it's just internet survey bots like Shodan which you don't need to worry about.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .