xchecker.net
has the same IP as unlinked.t-n-media.de
. So, both of them are pointing to the same server. Do you know you are running a proxy?
If not, I would suggest you shut it down, and rebuild your server.
Check the source, for the request above, it was 108.5.114.118
. If they keep bugging you, block them with iptables
. If there are a lot of different IP's, you are being hit from a bonnet. Not much you can do but take the pages offline.
The page exists for me:
The reverse DNS also doesn't add up:
[bart@dev ~]$ dig xchecker.net
; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6_2.3 <<>> xchecker.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15494
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;xchecker.net. IN A
;; ANSWER SECTION:
xchecker.net. 108 IN A 193.28.228.90
;; Query time: 11 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Aug 3 18:14:36 2012
;; MSG SIZE rcvd: 46
[bart@dev ~]$ dig -x 193.28.228.90
; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6_2.3 <<>> -x 193.28.228.90
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 515
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
;; QUESTION SECTION:
;90.228.28.193.in-addr.arpa. IN PTR
;; ANSWER SECTION:
90.228.28.193.in-addr.arpa. 2553 IN PTR unlinked.t-n-media.de.
;; Query time: 59 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Aug 3 18:14:44 2012
;; MSG SIZE rcvd: 79
If your server is not 193.28.228.90
, then someone has your domainname & '193.28.228.90' in their hostfile so it would resolve to you. If you see a lot of different IP's it's probably a change that was pushed to a lot of infected computers.
My guess would be that the IP of your server was used for some bad purposes in the past.
If you wan't to stop the 404's, you can put this on top of your vhost configuration:
<VirtualHost _default_:*>
RedirectMatch permanent ^/?(.*) http://myrealwebsite.com/
</VirtualHost>
This will redirect every unknown vhost to your main site.