logwatch reports "connection attempts using mod_proxy"

[Ow Mun Heng]

On Mon, 2005-07-04 at 10:23 -0400, Matt Morgan wrote:
> The httpd section of my logwatch reports:
> 
> Connection attempts using mod_proxy:
>    141.155.241.10 -> 1.3.3.7:1337 : 2 Time(s)
> 
> I have no idea what this means, and the message is resistant to my
> attempts to google it (or find it in the list archives). Any hints?
> Neither IP address bears any relation to the server reporting the
> connection attempt.

See Here -> http://httpd.apache.org/docs/mod/mod_proxy.html

Basically apache can also act as a proxy and they're searching for an
open proxy to connect to. 

> 
> I can't help noticing that the port (1337) spells "leet," i.e.,
> "elite," in script-kiddie nerdspeak. So I'm guessing it's some kind of
> bug exploit, but I don't know this one.
> 
> Thanks,
> Matt
> 

-- 
Ow Mun Heng
Gentoo/Linux on DELL D600 1.4Ghz 1.5GB RAM
98% Microsoft(tm) Free!! 
Neuromancer 22:25:42 up 2:13, 5 users, load average: 2.45, 1.80, 1.59