Spam domains in error log

Question

I can see a strange domain request in my error log:

2011/11/03 09:04:18 [error] 1203#0: *4044 FastCGI sent in stderr: "Successfully fetched 'http://jeannie733.2itb.com/oxycodonepricesideef.html': GET response code 200" while reading response header from upstream, client: 41.222.211.141, server: contra.net.au, request: "POST /wp-comments-post.php HTTP/1.1", upstream:

Does this indicate my site has been hacked?

Answer 1

Does this indicate my site has been hacked?

No, it means that a spam bot is trying to bypass the comments form. You can stop it by adding the belows config to server context in nginx.conf:

    set $poster "";
    if ($request_method = POST) {
        set $poster "${poster}P";
    }
    if ($request_uri = /wp-comments-post.php) {
        set $poster "${poster}W";
    }
    if ($http_referer !~ ^(jeannie733.2itb\.com) ) {
        set $poster "${poster}R";
    }
    if ($http_user_agent = "") {
        set $poster "${poster}U";
    }
    if ($poster = PWRU) {
        return 444;
    }

The 444 status code makes Nginx returns no information to the client and closes the connection.