I notice from my server logs that there have been a number of requests like

[01/Jun/2016:07:47:58 +0000] "\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01\x01" 400 181 "-" "-"

Should I be concerned about such requests, if so what should I do about them ?

  • 1
    This is the same question as on serverfault. I recommend checking here.
    – Bomskie
    Jun 1, 2016 at 10:15
  • @Bomskie I think that question should be migrated here, since this is IS, and that question is in SF. It might help to bring this here, as to not flood SF up.
    – EKons
    Jun 1, 2016 at 13:34
  • 2
    @ΈρικΚωνσταντόπουλος General policy when a question is on-topic on multiple sites is to leave them alone unless the OP specifically asks for a migration. (Unless asked by the same person, in which case it's cross-posting and generally bad.)
    – Bob
    Jun 2, 2016 at 2:48

1 Answer 1


These kinds of requests are commonly used for server fingerprinting. By sending a request that is likely to trigger an error other than a common 403, 404, 500, etc. they hope that the site operator did not set a custom error page, and that it will return a default error page with server type and version information. You'll often see really long URLs used to force a HTTP 414 response for the same reason.

As to whether it's malicious; it's probably an automated bot rather than a targeted attack. What they do after scanning is what determines whether it's malicious or not. A lot of the time it's just internet survey bots like Shodan which you don't need to worry about.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .