0

In my Apache Tomcat 8.5.56 localhost_access_log.2020-06-26.txt file there is, instead of a POST or GET request, a strange line:

X.X.X.X - - [26/Jun/2020:00:28:00 +0200] "CONNECT check.best-proxies.ru:80 HTTP/1.1" 400 795

what is it? Is it a socket connection? The server is exposed in the public cloud in the us-central-1a zone.

Davide Sestili
  • 101
  • 2
  • 9
  • 1
    It appears you were hit by a port scanner. But that no connection was established. This is not rare on internet-facing servers. – Adi Dembak Jun 27 '20 at 07:30
  • I tried to do a port scan with nmap on my machine from another machine within my local network and there are several lines in the log of Apache Tomcat 8.0.50 including this: `192.168.1.5 - - [06/Jul/2020:23:53:49 +0200] "CONNECT www.google.com:80 HTTP/1.0" 400 -` – Davide Sestili Jul 06 '20 at 22:18

1 Answers1

1

I'm afraid that what's inside of a GCP Instance is out of our expertise, anyway I'll do my best effort to help you.

This is some documentation that explains further what means the method "CONNECT". https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/CONNECT

The HTTP CONNECT method starts two-way communications with the requested resource. It can be used to open a tunnel.

Joan Marin
  • 36
  • 2