Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

this is what my web access.log looks like (well a short snippet)

46.4.33.46 - - [20/Jul/2011:11:56:18 +0100] "GET http://allegro.pl/matematyka-wokol-nas-6-zeszyt-cwiczen-czesc-1-2-i1727657348.html HTTP/1.0" 200 31161
78.159.125.176 - - [20/Jul/2011:11:56:17 +0100] "GET http://gotgirlspeeing.com/ HTTP/1.1" 200 110698
78.159.125.176 - - [20/Jul/2011:11:56:20 +0100] "GET http://gotgirlspeeing.com/js/search.js HTTP/1.1" 200 2842
184.173.219.98 - - [20/Jul/2011:11:56:59 +0100] "GET http://ads.lzjl.com/newServing/getkey.php?cb=getkey&ob=Yesup.infinityads.Code[0]&nid=5&pid=17587&sid=28749&spid=0&ns=0&nw=1&zone=0&url=http://www.mypaydayloan.com/&oe=ISO-8859-1&t3642160 HTTP/1.0" 200 762
208.115.238.200 - - [20/Jul/2011:11:59:45 +0100] "GET http://ad.xtendmedia.com/st?ad_type=iframe&ad_size=728x90&section=1697345 HTTP/1.0" 200 4580
1.197.203.145 - - [20/Jul/2011:11:59:45 +0100] "GET http://www.hardjob.net/proxyheader.php HTTP/1.0" 200 723
122.228.236.202 - - [20/Jul/2011:11:59:45 +0100] "GET http://ad.reduxmedia.com/st?ad_type=iframe&ad_size=728x90&section=755027 HTTP/1.0" 200 4574
59.45.185.14 - - [20/Jul/2011:11:59:45 +0100] "GET http://ads.clicksor.com/showAd.php?nid=1&pid=174828&adtype=&sid=270818 HTTP/1.0" 200 1489
221.215.112.238 - - [20/Jul/2011:11:59:45 +0100] "GET http://media.fastclick.net/w/get.media?sid=60107&tp=5&d=j&t=n HTTP/1.0" 302 280

My whole access.log is filled with lines like the above. Some including ebay links, some to car deals, some to porn. I really am lost in all of this, perhaps someone could offer some advice?

Since our logs started to look like this the server has really slowed down when it comes to serving pages, most of the time requests time out.

I'm guessing these things are related?

Many thanks,

Elliott

share|improve this question
add comment

2 Answers

When you see a request which is for a remote URL you're seeing somebody either scanning for a proxy - testing to see if they can route traffic via your machine - or using one that is unlocked.

It looks like, from the status codes of 200 + 302, your machine is configured with Apache's mod_proxy, which means people are bouncing traffic around.

If you're not deliberately using mod_proxy you should disable it. If you are using it for some purpose you should tighten up security.

share|improve this answer
    
Thank you for your quick reply Steve! When I disable mod_proxy I can no longer view my websites. Why would this be? I don't believe I should have a use for a proxy, so is there a way around it? I suppose this is the problem with Apple's "Hey just pick up a server today and anyone can run it"... Thanks again! –  Elliott Malone Jul 20 '11 at 12:04
    
I can't tell how you're using mod_proxy, but I do know it has a lot of security options. You should probably re-enable it only after reading: httpd.apache.org/docs/2.0/mod/mod_proxy.html –  Steve Kemp Jul 20 '11 at 13:16
add comment

In addition to Steves answer you could check Is my server being used as a proxy or is a DOS underway? Lots of traffic in my apache log - as pointed out there your IP might have previously used by a botnet.

share|improve this answer
    
Thanks I'm taking a look now! –  Elliott Malone Jul 20 '11 at 12:05
    
Strangely enough this did start happening when we changed our IP address... That's a tad worrying. –  Elliott Malone Jul 20 '11 at 12:07
    
Probably not as much as if your system itself had been hacked. Maybe requesting a "clean" IP address from your provider will solve the issue. –  Filburt Jul 21 '11 at 8:54
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.