Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

My apache2 log is bombarded with lines like:

108.5.114.118 - - [03/Aug/2012:15:23:28 +0200] "GET http://xchecker.net/tmp_proxy2012/http/engine.php HTTP/1.0" 404 1690 "http://xchecker.net/tmp_proxy2012/http/engine.php" "Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; Win 9x 4.90)"

I am puzzled by this -- why is a request for some weird xchecker.net domain ending up on my server in the first place?!

The request comes every few dozens of seconds, must be a robot. Any ideas what it is?

Btw that URL is valid -- apparently it contains some test page...

share|improve this question
    
Is it always from the same ip address? –  Mike Pennington Aug 3 '12 at 14:01
    
@Mike: not at all, many different IPs –  user1571418 Aug 3 '12 at 14:06
    
"why is a request for some weird xchecker.net domain ending up on my server in the first place?!" There isn't necessarily a reason. If your IP address is publicly available on the Internet, it will receive all manner of strange traffic. There is really nothing to stop me from pointing "mybaddomain.org" to your IP address, but you can configure your webserver to return an error for anything that you do not explicitly allow. This is the nature of the internet. –  Stefan Lasiewski Dec 7 '12 at 23:15

5 Answers 5

Somebody is checking if your server is a open proxy by requesting:
GET http://xchecker.net/tmp_proxy2012/http/engine.php HTTP/1.0

It doesn't look like you are running an open proxy since it responded with a 404.
For more information on this see: http://wiki.apache.org/httpd/ProxyAbuse
Especially the "But how can I be really sure that I am not allowing the abuse of other sites" part.

We can't tell why it continues to try it even after it should be clear that you don't run a proxy.
Maybe that guys script is broken.

share|improve this answer
    
Where is it checking, under which URL? I don't understand why this request for xchecker.net domain comes to my server at all. –  user1571418 Aug 3 '12 at 14:00
1  
No URL, 108.5.114.118 tried to request xchecker.net via your server (and failed). It comes to your server because 108.5.114.118 sends it. Check the link I added to my answer. –  faker Aug 3 '12 at 14:18

i too keep getting hit from this bot

i've just added this in my .htaccess

RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} xchecker\.net [NC]
RewriteRule .* - [F]

then in my error logs

[error] [client 91.237.249.35] client denied by server configuration: /var/www/html/proxy2012/http/engine7.php, referer: http://xchecker.net/proxy2012/http/engine7.php

so far so good.

Plus if the attacks are coming in super fast, you might want to think of using mod_evasive

I've sent a email to the unlinked.t-n-media.de but they have not responded.

share|improve this answer
    
Two notes: One, that rewrite can also go in vhost configuration, which is (or at least was) somewhat more efficient than .htaccess files. Two, with a non-core module like mod_evasive it would be considered cool to link the module page. –  pjmorse Sep 29 '12 at 1:04

xchecker.net has the same IP as unlinked.t-n-media.de. So, both of them are pointing to the same server. Do you know you are running a proxy?

If not, I would suggest you shut it down, and rebuild your server.

Check the source, for the request above, it was 108.5.114.118. If they keep bugging you, block them with iptables. If there are a lot of different IP's, you are being hit from a bonnet. Not much you can do but take the pages offline.

The page exists for me:

enter image description here

The reverse DNS also doesn't add up:

[bart@dev ~]$ dig xchecker.net

; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6_2.3 <<>> xchecker.net
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 15494
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;xchecker.net.          IN  A

;; ANSWER SECTION:
xchecker.net.       108 IN  A   193.28.228.90

;; Query time: 11 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Aug  3 18:14:36 2012
;; MSG SIZE  rcvd: 46

[bart@dev ~]$ dig -x 193.28.228.90

; <<>> DiG 9.7.3-P3-RedHat-9.7.3-8.P3.el6_2.3 <<>> -x 193.28.228.90
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 515
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;90.228.28.193.in-addr.arpa.    IN  PTR

;; ANSWER SECTION:
90.228.28.193.in-addr.arpa. 2553 IN PTR unlinked.t-n-media.de.

;; Query time: 59 msec
;; SERVER: 8.8.8.8#53(8.8.8.8)
;; WHEN: Fri Aug  3 18:14:44 2012
;; MSG SIZE  rcvd: 79

If your server is not 193.28.228.90, then someone has your domainname & '193.28.228.90' in their hostfile so it would resolve to you. If you see a lot of different IP's it's probably a change that was pushed to a lot of infected computers.

My guess would be that the IP of your server was used for some bad purposes in the past.

If you wan't to stop the 404's, you can put this on top of your vhost configuration:

<VirtualHost _default_:*>
  RedirectMatch permanent ^/?(.*) http://myrealwebsite.com/
</VirtualHost>

This will redirect every unknown vhost to your main site.

share|improve this answer
    
There is no page (404), so nothing to take offline. Also, if I'm not running a proxy, how can I shut it down? –  user1571418 Aug 3 '12 at 14:08
    
I don't know about you, but the site definitely exists for me, I'll update with some more information about name records. –  Bart De Vos Aug 3 '12 at 14:12
    
Aha, so a forced DNS resolution on infected machines, that's why I receive the requests. And my Apache responds to them, even though no such vhost is configured? Is it possible to switch off this Apache behaviour (ignore requests for unknown domains)? –  user1571418 Aug 3 '12 at 17:54
1  
Btw thanks for the investigation Bart, I will upvote once I have enough karma. –  user1571418 Aug 3 '12 at 17:54
    
@user1571418: No problem, updated above. –  Bart De Vos Aug 3 '12 at 17:56

I've run into this problem plenty of times -- getting hit from thousands of unique IPs. They didn't seem to care that my server refused to proxy. They just kept hitting it. My solution was to write a short app that tailed the access log and looked for hits matching the pattern. ie Requests for content on other domains. As they were parsed, I added them to the iptables drop list.

Server resource load dropped DRAMATICALLY!

share|improve this answer
1  
Have you ever heard of fail2ban? –  Michael Hampton Aug 1 '13 at 18:50

I also see many of these request in my logs, searching for server's IP address and proxy in google I came to this list: http://vietyahoo.vn/http-proxy/4341-list-http-proxies-thang-12-a-2.html

It seems to be a tool with a list of all our servers to be used as a proxy.

I found 3 of my server's IP addresses and do not longer wonder why I got so many requests, even if they got only errors.

I added an empty web for the IP addresses, since my customers use the names only, that should help to get out of the list soon, I hope.

share|improve this answer
    
And did you disable proxying, too? –  sendmoreinfo Aug 22 '13 at 19:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.