Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have an Apache2 instance that started receiving hundreds of requests/s for some reason, for all sorts of domains that are not hosted here. There is nothing public running on it.

Here's an excerpt of the access.log:

Facts of interest:

  • bind9 was installed on it for a few days, but is not running anymore
  • recently switched to a static IP
  • there is a public subdomain (i.e. pointing to the machine
  • ports 22, 80, and a few others forwarded from the router

iftop shows many active connections to

and other variations of these, all to ports that are blocked on the router.

nethog shows PID 0 for those...

0     root     ..1:80-             0.000       0.000 KB/sec
share|improve this question
Could you post the IP? Looks like it is set up as a proxy on numerous hosts for some mysterious reason. – the-wabbit Dec 14 '11 at 23:38
up vote 2 down vote accepted

From your logs it looks like someone is using your apache server as a proxy and what's troubling is that it looks like you are returning 200 ok to those proxy requests: - - [14/Dec/2011:20:26:53 -0200] "POST HTTP/1.1" 200 11547

Return value is "200" and you served "11547" bytes. You should check your apache config to make sure you aren't configured as an open proxy.

share|improve this answer
Oh god.. the only enabled config has ProxyRequests On followed by a ProxyPass directive. Does that make it an open proxy? – Ricardo Tomasi Dec 14 '11 at 23:45
It's definitely proxying arbitrary requests for me. Turn ProxyRequests OFF! It is only used for forward proxies, not reverse proxy (which is what ProxyPass does) – Jon Lin Dec 14 '11 at 23:52
I disabled mod_proxy, now giving out 500 responses. How long should I expect until requests stop coming in? – Ricardo Tomasi Dec 15 '11 at 0:00
It should be fine if you set ProxyRequests Off. I'm sure eventually they'll stop hammering your server but if it starts to proxy for anyone again, expect to start getting hammered again. – Jon Lin Dec 15 '11 at 0:04
Yeah, it probably started to get visibility when we switched to the fixed IP. Thanks a lot! – Ricardo Tomasi Dec 15 '11 at 0:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.