[RndTbl] weird web hit 80 & 443?

[Trevor Cordes]

5.6.7.8 - - [17/Apr/2024:00:17:59 -0500] "GET / HTTP/1.0" 400 362 "-" "-" sampledomainfoobar.com 1.2.3.4 80 443 HTTP/1.0 - - 56

Apache 2.4.

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %v %A %p %{local}p %H %f %L %D" teccombinedwithpath

How can I get a hit where %p is 80 and %{local}p is 443?

https://httpd.apache.org/docs/2.4/mod/mod_log_config.html#formats

%p		The canonical port of the server serving the request.

%{format}p	The canonical port of the server serving the request, or
the server's actual port, or the client's actual port. Valid formats are
canonical, local, or remote.

One vhost is listening on 80, the other 443.  Pretty standard setup.  80
does a redir to 443.  HTTP2 is present, but the hit shows HTTP1.

And apache gets confused and throws a 400.

Looking at the very few hits like this it seems like some sort of probe:
other probes occurring at the same time.

Just wondering that they are doing to achieve this hit.