On Fri 06/Feb/2026 21:42:11 +0100 Yehuda Katz wrote:
HTTP 408 means the client opened a connection but didn't send a request.
This could be caused by anything from a misconfigured or buggy program on
the client side, to a malicious actor trying to overwhelm your server with
fake connections.
Yesterday, I had 255,769 connections to port 443, while access.log only had
3,798 lines. So, something was up for 408, albeit not a complete request.
access.log had 9 lines with a 408 error. Five of these appear to be real users
accessing a page along with its images/CSS, using AppleWebKit. The 408 error
appeared a few moments after the last request. Perhaps something to keep the
connection alive?
On Fri, Feb 6, 2026, 3:18 PM Knute Johnson <[email protected]> wrote:
From my access.log
181.215.169.144 - - [06/Feb/2026:20:10:38 +0000] "-" 408 7240 "-" "-"
194.180.179.107 - - [06/Feb/2026:20:10:47 +0000] "-" 408 7240 "-" "-"
194.180.179.107 - - [06/Feb/2026:20:10:47 +0000] "-" 408 7240 "-" "-"
194.180.179.107 - - [06/Feb/2026:20:10:47 +0000] "-" 408 7240 "-" "-"
FWIW, the first IP wasn't found on AbuseIPDB. Se second only has a few reports
from a month ago.
Best
Ale
--
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
