Re: centos 5 logwatch
Has anyone ever looked into why verisign does this from these ips fairly
frequently?
It appears that it is some type of SSL probing the HTTP port, correct?
Are they just gathering stats or something ?
--------------------- httpd Begin ------------------------
A total of 2 sites probed the server
216.168.253.197
216.168.253.198
.....
The first ip is a3-pip6.verisign.net
The second ip is a3-pip7.verisign.net
Here is grep from logs
216.168.253.197 - - [01/Sep/2008:13:30:19 -0700] "\x80@\x01\x03" 501 304
216.168.253.197 - - [01/Sep/2008:14:02:08 -0700] "\x80@\x01\x03" 501 304
216.168.253.197 - - [05/Sep/2008:22:16:20 -0700] "\x80@\x01\x03" 501 304
216.168.253.197 - - [05/Sep/2008:22:16:29 -0700] "\x80@\x01\x03" 501 297
216.168.253.197 - - [09/Sep/2008:15:26:54 -0700] "\x80@\x01\x03" 501 304
216.168.253.197 - - [09/Sep/2008:15:27:04 -0700] "\x80@\x01\x03" 501 304
216.168.253.197 - - [09/Sep/2008:15:27:13 -0700] "\x80@\x01\x03" 501 297
216.168.253.198 - - [02/Sep/2008:07:00:39 -0700] "\x80@\x01\x03" 501 304
216.168.253.198 - - [02/Sep/2008:07:48:42 -0700] "\x80@\x01\x03" 501 297
216.168.253.198 - - [03/Sep/2008:15:04:50 -0700] "\x80@\x01\x03" 501 297
216.168.253.198 - - [05/Sep/2008:22:19:52 -0700] "\x80@\x01\x03" 501 297
216.168.253.198 - - [09/Sep/2008:15:26:52 -0700] "\x80@\x01\x03" 501 297
- rh