Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I administer a web server and recently we had our IP banned (!) from our host after they received a notification e-mail for abuse. In particular our server is allegedly involved in spam attacks over HTTP. The content of the abuse report email we received was not much informative - for example the IP addresses our server is supposed to have attacked against are not included - so I started a wireshark session checking for suspicious traffic over TCP/HTTP while trying to locate possible security holes on the system. (Let me note that the machine runs a Debian OS).

Here is an example of such a request...

Destination:  // my ip
Protocol: HTTP
Info: GET '' HTTP/1.0

I manually blacklisted this host (as well as some other ones) blocking them with iptables, but I can't keep on doing manually all day long... I'm looking for an automated way to block such IPs based on:

  1. Statistical analysis, pattern recognition or other AI-based analysis (Though, I'm reluctant to trust such a solution, if exists)
  2. Public blacklists

Using DNSBL I actually found out that is blacklisted. However other IPs which are strongly suspicious like (i.e., unfortunately were not blacklisted! What I would like to do is to automatically connect my firewall with DNSBL (or some other blacklist database) and block all traffic towards blacklisted IPs or somehow have my local blacklist automatically updated.

Update 1: My main question here consists in configuring iptables to automatically block all IPs that are blacklisted in a public database such as this one. I'm looking for a tool that will automatically update my local blacklist adding any blacklisted IPs and of course removing them once their issues have been resolved (Would not be nice to block forever an IP because it once happened to be blacklisted). I don't really understand the utility of a blacklist web service without the ability to be consumed by iptables.

share|improve this question

I would first make sure that you've not unintentionally become an HTTP proxy that people are using to relay mail through.

share|improve this answer
According to the server is not an open relay and I don't have a proxy server running. Which is the most reliable way to verify if something has gone wrong? – Pantelis Sopasakis Mar 14 '11 at 17:08 appears to only check SMTP relay. I would 1) portscan the machine in question with nmap, and see what ports are really open, 2) check that against the results of "netstat -an" on the machine itself. If you find a difference, you may have malware or a rootkit running. Check your http server with or a similar tool, as well. Do you forward mail for anyone, as in "localuser: user@remote-system" in your alias file? That can sometimes end up generating abuse reports, because your ip is in the received msg header chain. – malcolmpdx Mar 14 '11 at 22:14
I noticed that the server is blacklisted in with the message: " - Open Proxy - This host has been detected as an open proxy. This means that the machine allows others to use the machine in question to 'relay' or 'bounce' their traffic.". I'm investigating further to find the root of the problem. I used to have a squid and an MTA in order to send notification emails to the administrators. I'm suspecting squid - How can I secure it? – Pantelis Sopasakis Mar 15 '11 at 1:05
Make sure squid is off, if you're not using it, and not configured to restart automatically. If you are using it, I would read the docs and google "securing squid" and you'll get what you need. – malcolmpdx Mar 18 '11 at 16:36

Are you running anything that acts as a HTTP proxy on your machine? If you do, look at locking atht down. If not, investigate your machine as a whole. Unless you have explicitly allowed random code to run on your server, you may be looking at a compromised machine.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.