4

My apache2 log is bombarded with lines like:

108.5.114.118 - - [03/Aug/2012:15:23:28 +0200] "GET http://xchecker.net/tmp_proxy2012/http/engine.php HTTP/1.0" 404 1690 "http://xchecker.net/tmp_proxy2012/http/engine.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"

I am puzzled by this -- why is a request for some weird xchecker.net domain ending up on my server in the first place?!

The request comes every few dozens of seconds, must be a robot. Any ideas what it is?

Btw that URL is valid -- apparently it contains some test page...

3
  • Is it always from the same ip address? Aug 3, 2012 at 14:01
  • @Mike: not at all, many different IPs Aug 3, 2012 at 14:06
  • "why is a request for some weird xchecker.net domain ending up on my server in the first place?!" There isn't necessarily a reason. If your IP address is publicly available on the Internet, it will receive all manner of strange traffic. There is really nothing to stop me from pointing "mybaddomain.org" to your IP address, but you can configure your webserver to return an error for anything that you do not explicitly allow. This is the nature of the internet. Dec 7, 2012 at 23:15

5 Answers 5

3

Somebody is checking if your server is a open proxy by requesting:
GET http://xchecker.net/tmp_proxy2012/http/engine.php HTTP/1.0

It doesn't look like you are running an open proxy since it responded with a 404.
For more information on this see: http://wiki.apache.org/httpd/ProxyAbuse
Especially the "But how can I be really sure that I am not allowing the abuse of other sites" part.

We can't tell why it continues to try it even after it should be clear that you don't run a proxy.
Maybe that guys script is broken.

2
  • Where is it checking, under which URL? I don't understand why this request for xchecker.net domain comes to my server at all. Aug 3, 2012 at 14:00
  • 1
    No URL, 108.5.114.118 tried to request xchecker.net via your server (and failed). It comes to your server because 108.5.114.118 sends it. Check the link I added to my answer.
    – faker
    Aug 3, 2012 at 14:18
3

i too keep getting hit from this bot

i've just added this in my .htaccess

RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} xchecker\.net [NC]
RewriteRule .* - [F]

then in my error logs

[error] [client 91.237.249.35] client denied by server configuration: /var/www/html/proxy2012/http/engine7.php, referer: http://xchecker.net/proxy2012/http/engine7.php

so far so good.

Plus if the attacks are coming in super fast, you might want to think of using mod_evasive

I've sent a email to the unlinked.t-n-media.de but they have not responded.

1
  • Two notes: One, that rewrite can also go in vhost configuration, which is (or at least was) somewhat more efficient than .htaccess files. Two, with a non-core module like mod_evasive it would be considered cool to link the module page.
    – pjmorse
    Sep 29, 2012 at 1:04
2

xchecker.net has the same IP as unlinked.t-n-media.de. So, both of them are pointing to the same server. Do you know you are running a proxy?

If not, I would suggest you shut it down, and rebuild your server.

Check the source, for the request above, it was 108.5.114.118. If they keep bugging you, block them with iptables. If there are a lot of different IP's, you are being hit from a bonnet. Not much you can do but take the pages offline.

The page exists for me:

enter image description here

The reverse DNS also doesn't add up:

[bart@dev ~]$ dig xchecker.net

; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6_2.3 <<>> xchecker.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15494
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;xchecker.net.          IN  A

;; ANSWER SECTION:
xchecker.net.       108 IN  A   193.28.228.90

;; Query time: 11 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Aug  3 18:14:36 2012
;; MSG SIZE  rcvd: 46

[bart@dev ~]$ dig -x 193.28.228.90

; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6_2.3 <<>> -x 193.28.228.90
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 515
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;90.228.28.193.in-addr.arpa.    IN  PTR

;; ANSWER SECTION:
90.228.28.193.in-addr.arpa. 2553 IN PTR unlinked.t-n-media.de.

;; Query time: 59 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Aug  3 18:14:44 2012
;; MSG SIZE  rcvd: 79

If your server is not 193.28.228.90, then someone has your domainname & '193.28.228.90' in their hostfile so it would resolve to you. If you see a lot of different IP's it's probably a change that was pushed to a lot of infected computers.

My guess would be that the IP of your server was used for some bad purposes in the past.

If you wan't to stop the 404's, you can put this on top of your vhost configuration:

<VirtualHost _default_:*>
  RedirectMatch permanent ^/?(.*) http://myrealwebsite.com/
</VirtualHost>

This will redirect every unknown vhost to your main site.

5
  • There is no page (404), so nothing to take offline. Also, if I'm not running a proxy, how can I shut it down? Aug 3, 2012 at 14:08
  • I don't know about you, but the site definitely exists for me, I'll update with some more information about name records. Aug 3, 2012 at 14:12
  • Aha, so a forced DNS resolution on infected machines, that's why I receive the requests. And my Apache responds to them, even though no such vhost is configured? Is it possible to switch off this Apache behaviour (ignore requests for unknown domains)? Aug 3, 2012 at 17:54
  • 1
    Btw thanks for the investigation Bart, I will upvote once I have enough karma. Aug 3, 2012 at 17:54
  • @user1571418: No problem, updated above. Aug 3, 2012 at 17:56
0

I've run into this problem plenty of times -- getting hit from thousands of unique IPs. They didn't seem to care that my server refused to proxy. They just kept hitting it. My solution was to write a short app that tailed the access log and looked for hits matching the pattern. ie Requests for content on other domains. As they were parsed, I added them to the iptables drop list.

Server resource load dropped DRAMATICALLY!

1
  • 1
    Have you ever heard of fail2ban? Aug 1, 2013 at 18:50
0

I also see many of these request in my logs, searching for server's IP address and proxy in google I came to this list: http://vietyahoo.vn/http-proxy/4341-list-http-proxies-thang-12-a-2.html

It seems to be a tool with a list of all our servers to be used as a proxy.

I found 3 of my server's IP addresses and do not longer wonder why I got so many requests, even if they got only errors.

I added an empty web for the IP addresses, since my customers use the names only, that should help to get out of the list soon, I hope.

1
  • And did you disable proxying, too? Aug 22, 2013 at 19:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .