topic LOG messages in Network Security

LOG messages

Spinu Viorel — Mon, 11 Mar 2019 14:18:27 GMT

Can u please tell me what these messeges say?

1) %APPFW-4-HTTP_DEOBFUSCATE: Sig:14 Deobfuscation signature detected - HTTP deobfuscation detected IDS evasion technique from 172.31.0.71:15909 to 4.71.209.4:80

2) %APPFW-4-HTTP_STRICT_PROTOCOL: Sig:15 HTTP protocol violation detected - HTTP Protocol not detected from 172.31.5.148:2901 to 72.30.186.249:80

thank u

Re: LOG messages

torchris — Wed, 26 Nov 2008 23:23:53 GMT

sure

It is an attack

Re: LOG messages

ariesc_33 — Thu, 27 Nov 2008 04:13:09 GMT

looks like the attack is coming from the internal network. go check which pc or server is 172.31.0.71 and scan for spyware or worm infection.

for the mean while, you may block this IP to stop it spreading.