Re: Probed Server

[Roger Dingledine <arma@xxxxxxx>]

On Fri, May 25, 2007 at 12:37:31PM -0700, Mr. Blue wrote:
> Someone probed my server just recently like this:
> 
> [Fri May 25 20:29:21 2007] [error] [client
> 62.21.10.223] File does not exist:
> /*****************/public_html/tor/server/d/0182EBC4E979994EB3D263FE414E4B77DBD22411+306208F37D6BBEF9B77363403CC3E3F476BD37C3+F3762B92C74FE9C1C98FD2EC399BE02D4FDC0115+C002882FB0A492B4149E6C820D495B72BEFDB4AF+740CC21909B142774BA1AEEEAC5BE412BEEEA51F+DCA1587A16C9FF09E9B7D4F7E3E75D8AB88B6241+73235CBE0639B6A514118447BC72348DD5A5A8A8+90F7023A54D5DC78835EC9D53F885A891BA16A67+129923AFB6EC069BA2D123245CEB7738AA4694E6+4114AB55D490E7AE343EF66B28EB674A1652B43C+B9065EDFA2037EDAF2168E9D412A8F17D1F4ECB9+AAE20EF0A1DF1914E0C317FA26362E79132FF2ED+FE01A8D16E694FC2E1A177741CBAC0DFBEDDBA9C+F0921279AB5AB26486C757A8851A3369A8C42EE1+63EDE492AF128A7E58BB465B506C3E45E7E824A6+3F0A0050E03F2B51812E362596B3F54176779A1B+F49D123C17166B145C524F6815A58766BD14425A.z
[snip]
> What has he been searching for?

Those are Tor directory requests.

Most likely he thought you were running a Tor directory mirror on that
port.

Perhaps you used to advertise port 80 for your Tor server's directory
mirror? (Or you still do?)

Another possibility is that you're on a dynamic IP address and somebody
else was running one on there before you inherited that IP address.

--Roger