1

So here is a fun one. I'm getting bingbot requests at a certain time everyday that kill the server. Here is the request:

127.0.0.1 - - [14/Sep/2013:08:18:49 -0500] "GET / HTTP/1.1" 200 82810 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)"

I'm pretty sure you can't spoof 127.0.0.1, right?

And I checked the server a thousand times for any malicious code but I came up emtpy. Searched google and didn't find much. I found many people with bingbot spoofing and sending so many requests it would kill the server but not using the 127.0.0.1 ip address.

Anyone seen this before or have any ideas?

1 Answer 1

0

I wonder if you have a proxy server of some kind running on the web server, or if perhaps you have some kind of strange local iptables rule conducting SNAT to this address.

Alternatively, if you happen to be using a javascript-capable browser (interactively?) on the server, it might be that you've run a malicious script in it that happens to be attacking your server.

You might also have some other kind of worm; the thing with these is that they often use tricks to infect servers without being on disk at runtime (there are various ways to achieve persistence, or sometimes persistence is achieved through infecting a whole network). That you can't find a virus in the filesystem doesn't mean it's not there; similarly it might (like the malicious JS example) be hiding inside an otherwise legitimate process.

2
  • You maybe right about the virus. l'll have to run a check on it tonight. Not sure how it would happen. Very limited access. No GUI on server, strictly terminal. I don't believe I installed a proxy server. Ill keep searching, in the mean time Ill lock the server down even further.
    – Alan
    Sep 15, 2013 at 18:22
  • The best thing to do with a compromised server is to nuke it and restore from a clean backup, but you should try and track down where the virus is in your network if it's floating around. This can be hard without a security guy. Sep 15, 2013 at 18:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .