Kristofer
Thu Aug 04 08:06:39 CDT 2005
401 means access is denied. It is possible that whatever is accessing your
webserver is denied access, hence this is logged. When you do the same
request using your machine name, IE automatically logs you on, and you are
therefore not denied access.
Why would you consider this a threat? Your server is publicy available,
and someone tried to access your website's root directory ( / ). I would
say that it is quite normal activity on a webserver. If you see multiple
requests trying to access different parts of your website (scanning your
website for possible holes) then it might be something to worry about. But
a request to the root directory is normal.
If you do not intend to have the webserver public (and that is why you
worry about this), then you need to fix that instead.
--
Regards,
Kristofer Gafvert (IIS MVP)
http://www.gafvert.info/iis/ - IIS Related Info
InNeedOfAssistance wrote:
>In the past few days, several entries like the following have showed up in
>my 2003 server web log from several different ip addresses. I see the
>server response is 401-unauthorized but am unsure if I should consider
>this as a threat and block these IP addresses or if this might be an
>incorrect address given by an image bot.
>
> 2005-08-03 01:09:58 GET / - 68.80.33.236 - - 401 0 5698 125
>
>I'm also interested in knowing what they did to create an entry in my log
>such as this. When I browse to
http://myComputer/ I get the website under
>construction page and quite a different entry in the log file.
>
>Your help would be greatly appreciated.
>
>Thank you.