0

I have a linux apache server which was running fine until a few days ago. What happened is from the access log there are lines like this, and the log file is growing by many lines every second. Initially I suspected the server was dos attacked and stopped the server. but after several days whenever I start the server, similar log happens. I'm wondering if anyone know what is happening? is it caused by a virus?

23.19.76.217 - - [17/Oct/2012:10:21:47 -0400] "GET http://ad.globe7.com/st?ad_type=iframe&ad_size=728x90&section=3633732&pub_url=${PUB_URL} HTTP/1.0" 200 4497
142.54.177.114 - - [17/Oct/2012:10:21:47 -0400] "GET http://ad.globe7.com/imp?Z=300x250&s=3582878&T=3&_salt=3106601030&B=12&m=2&u=http%3A%2F%2Fwww.homesearchcar.com%2F%3Fp%3D184&r=1 HTTP/1.0" 302 -

4 Answers 4

5

Looks like you've accidentally configured an open proxy server, and the Internet found out about it.

So everyone and their mother is now using your server to proxy their web connections and hide what they're doing. In this particular case, your server is being used to abuse an ad network. You will be blamed for this.

Shut down your server as soon as possible, and reconfigure it to deny proxy access, or allow it only where it's absolutely necessary.

1
  • The downvote really needs an explanation. Oct 17, 2012 at 14:53
1

I've just been hit by the same problem, and my server definitely wasn't running an open proxy - the requests were all hitting the default site, and this was overwhelming the database server. Looks like a badly written click-fraud botnet - it's trying to use open proxies but not checking if it's successful or not. I've seen requests from ~1,500 IP addresses, so blocking them isn't practical.

Adding this as the first (and therefore default) Virtual Host worked for me

<VirtualHost *:80>
  ServerName default.only
  <Location />
    Order allow,deny
    Deny from all
  </Location>
</VirtualHost>

(from http://wiki.apache.org/httpd/ProxyAbuse)

The variant which I was hit with was also requesting pages on these ad servers:

  • ad.adorika.com/
  • ad.adserverplus.com/
  • ads1.ministerial5.com/
  • ads.clovenetwork.com/
  • ads.creafi-online-media.com/
  • ad.tagjunction.com/
  • ax-d.pixfuture.net/
  • ib.adnxs.com/
  • www.mmadsgadget.com/
1
  • Big thanks for this, this was the only thing that worked for me as well. These proxy requests were being denied, but the sheer volume was completely overwhelming the small VM and the access log was growing too fast to keep up.
    – KyleT
    Mar 16, 2022 at 17:37
1

try to put this on your .htaccess

#-Prevent proxy access
#
RewriteEngine on
RewriteCond %{HTTP:VIA} !^$ [OR]
RewriteCond %{HTTP:FORWARDED} !^$ [OR]
RewriteCond %{HTTP:USERAGENT_VIA} !^$ [OR]
RewriteCond %{HTTP:X_FORWARDED_FOR} !^$ [OR]
RewriteCond %{HTTP:PROXY_CONNECTION} !^$ [OR]
RewriteCond %{HTTP:XPROXY_CONNECTION} !^$ [OR]
RewriteCond %{HTTP:HTTP_PC_REMOTE_ADDR} !^$ [OR]
RewriteCond %{HTTP:HTTP_CLIENT_IP} !^$
RewriteRule .* - [F]
#

and you will notice the 2nd to the last line on the log.

...732&pub_url=${PUB_URL} HTTP/1.0" 200 4497

becomes

...732&pub_url=${PUB_URL} HTTP/1.0" 404 4497
1
  • While this may work, he could simply disable the proxy functionality directly instead of using mod_rewrite as access control. Additionally, .htaccess files are to be avoided as they decrease performance and may also decrease security. Jun 28, 2013 at 7:11
-1

That doesn't look like a Virus, but really it's kind of hard for us to tell you much as we don't know what's "normal" traffic looks like... but either case if you think this is bad traffic then you should block it using build-in apache mechanism or there is always a firewall)

take a look at your script that're being called

http://ad.globe7.com/st
document.write("<span>Smart Tag Error: Malformed URL - ST_NO_AD_TYPE_GIVEN </span>");

http://ad.yieldmanager.com/imp?
// Invalid tag - code 1, Invalid size, entity=0

is this normal behavior? is this even yours?

2
  • Are you trying to answer the question or ask the user for more information? If the latter, you should post a comment. It doesn't appear that you know the answer to this question, so posting an answer is almost certainly not appropriate. Oct 17, 2012 at 14:54
  • I proposed block offender IPs (just like you) if this is not legitimate traffic, but its hard to know from outsider what's legitimate and whats not. your answer on the other hand I dont know how you determinate that this is open proxy... I host proxys and they dont produce lines such as this..
    – alexus
    Oct 17, 2012 at 15:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .