Apache Logs – Understanding HTTP Requests “\x80z\x01\x03\x01”

apache-2.2

I'm having lots of the following HTTP requests in my Apache access log:

178.91.64.43 - - [17/May/2012:16:33:22 +0400] "\x80z\x01\x03\x01" 200 65900 "-" "-"

My site stops working because of them. So, I just block all such IPs with my csf firewall. I am on CentOS 5.8 with Apache 2.2.4.

Can you help me understand what these requests are? I am not able to google anything and just need a point from which to start in order to resolve this issue.

Thank you.

Update.

Web server is listening to the port 443.

   tcp  0    0 :::443    :::*    LISTEN      0   2686146530 19775/httpd

Best Answer

That looks like someone trying to connect using SSL to a non-SSL port (i.e. https://).

Either the connecting clients are getting something wrong, or perhaps your web server is listening on port 443, but not for SSL connections?

You could create an Apache customlog using %p somewhere in the output, and track which port those connections are actually turning up on. If they're on port 443 then your config is potentially the issue, if they're on port 80, I'm not sure what to suggest.