Malformed message from...

[MrCook1es]

hi, I already have a Snipa XNP.
This time I created a new XNP from scratch, the MoneroOcean fork.

The proxy works great, but some times I found a lot of this error message, always with the same IP address:

/home/nodeproxy/.pm2/logs/proxy-error.log

2018-10-05 15:07:14:659 +02:00: Malformed message from 123.249.27.171 Message: GET http://47.99.121.32:39169/Ip/Up?Ip=[XNP-IP]&Port=8080&Check=296&Order=123.249.27.171 HTTP/1.1
2018-10-05 15:12:37:616 +02:00: Malformed message from 47.99.121.32 Message: GET http://47.99.121.32:39169/IP/Check?Ip=[XNP-IP]&Port=8080&Check=296 HTTP/1.1
2018-10-05 15:55:23:086 +02:00: Malformed message from 61.176.223.98 Message: GET http://47.99.121.32:39169/Ip/Up?Ip=[XNP-IP]&Port=8080&Check=296&Order=61.176.223.98 HTTP/1.1

I have masked my XNP IP address with: [XNP-IP]
But I don't know what is the other IP address and what is the meaning of this error messages.

• 47.99.121.32
• 123.249.27.171
• 61.176.223.98

I have checked on the browser:
the first complete url show this message: "Success"
the second complete url show this message: "[IP-ADDRESS-OF-THE-MINER]"
the third complete url show this message: "Success"

[MoneroOcean]

It is just some random IP crawlers that access your open ports (which are visible to outside world, right?). Nothing to worry about much.

[djfinch]

I'm facing this as well. Solved using iptables with geoIP block for CH, RUS and so...

[MrCook1es]

edit
@djfinch thanks!

[djfinch]

You're welcome. Many error records are about cookies and mstshash=*. These are mostly sent by webcrawlers. When you try to open proxy address/IP:mining_port with web browser then node-http will answer you with HEAD 200 OK and content "Mining proxy online".