[cobalt-users] Hacked?

[Paul Warner <pwarner@xxxxxxxxxxxxxxxxxx>]

Strange entries in the apache this morning...looked through all I know to
check and see no evidence that it was successful.  Netstat, logs, chkrootkit
output all seem normal.  Anything else obvious I should check?  The
following sequence was repeated 30 minutes later from another netblock
(first .jp and second .lt)

[Tue Sep 24 03:01:12 2002] [error] [client xxx.xxx.xxx.xxx] client sent
HTTP/1.1 request without hostname (see RFC2616 section 14.23): /
[Tue Sep 24 03:01:12 2002] [error] [client xxx.xxx.xxx.xxx] client sent
HTTP/1.1 request without hostname (see RFC2616 section 14.23): /
[Tue Sep 24 03:01:12 2002] [error] [client xxx.xxx.xxx.xxx] client sent
HTTP/1.1 request without hostname (see RFC2616 section 14.23): /
[Tue Sep 24 03:01:12 2002] [error] [client xxx.xxx.xxx.xxx] client sent
HTTP/1.1 request without hostname (see RFC2616 section 14.23): /
[Tue Sep 24 03:01:20 2002] [error] mod_ssl: SSL handshake failed (server
yyy.yyy.yyy.yyy:443, client xxx.xxx.xxx.xxx) (OpenSSL library error follows)
[Tue Sep 24 03:01:20 2002] [error] OpenSSL: error:1406908F:SSL
routines:GET_CLIENT_FINISHED:connection id is different
[Tue Sep 24 03:01:21 2002] [notice] child pid 27426 exit signal Segmentation
fault (11)