Thread created on Thu Jun 28, 2012 04:07:24 Last replied to on Sun Nov 25, 2012 23:02:03
Hello there,
I've noticed there are a lot of bad HTTP requests going to the IP address 83.223.121.71
by a lot, it's about every 5 - 10 seconds that I have Torn.com open. The destination IP address is a Facebook IP. While this isn't a serious problem, it does put a noticeable load on the network and means I can't leave it open throughout the day
Below is a snippet form my proxy logs.
Jun 25 16:13:52 XXXXXX sport[24535]: [http/server.NOTICE] 4736937 {[MyPC IP]:4198 83.223.121.71:80} 10 Your browser sent an invalid request.10/body/html10
Jun 25 16:13:53 XXXXXX sport[24535]: [http/server.NOTICE] 4736941 {[MyPC IP]:4216 83.223.121.71:80} NULL response on SFE. Pkt= HTTP/1.0 400 Bad request1310Cache-Control: no-cache1310 Connection: close1310Content-Type: text/html13101310htmlbodyh1400 Bad request/h1
Jun 25 16:13:53 XXXXXX sport[24535]: [http/server.NOTICE] 4736941 {[MyPC IP]:4216 83.223.121.71:80} 10 Your browser sent an invalid request.10/body/html10
Jun 25 16:14:04 XXXXXX sport[24535]: [http/server.NOTICE] 4736962 {[MyPC IP]:4220 83.223.121.71:80} NULL response on SFE. Pkt= HTTP/1.0 400 Bad request1310Cache-Control: no-cache1310 Connection: close1310Content-Type: text/html13101310htmlbodyh1400 Bad request/h1
Jun 25 16:14:04 XXXXXX sport[24535]: [http/server.NOTICE] 4736962 {[MyPC IP]:4220 83.223.121.71:80} 10 Your browser sent an invalid request.10/body/html10
Thanks for the report. Can you tell me what page you are on? Where are you getting that log from - a prpxy server? Most likely we have some misbehaving javascript that needs fixing.
I was getting it on a number of pages...
- Home
- Gym
- Crimes
- The front page before logging in (ie. www.torn.com)
I could assume it would be on all pages from that list but I haven't checked. I was getting the alerts from my Riverbed (WAN accelerator), it acts a bit like a proxy for HTTP traffic.
I dont see any major problem, we request a bunch of pages from Facebook and I dont see any obviously invalid ones.
I cant imagine this is going to cause your Riverbed any major dramas, it just wont be able to accelerate the request.
Closing as "more info" unless you can tell me exactly what URL is being hit from what page *And* you tell me this is causing you an actual problem rather than a log entry in a Riverbed alone!
![refractive [1642571]](http://awardimages.torn.com/1642571-58628-large.png "refractive [1642571]")
![RatedR [72498]](http://awardimages.torn.com/72498-21590-large.png "RatedR [72498]")
![Davzz [323969]](http://awardimages.torn.com/323969-92426-large.png "Davzz [323969]")
Follow @TornRPG