Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a linux apache server which was running fine until a few days ago. What happened is from the access log there are lines like this, and the log file is growing by many lines every second. Initially I suspected the server was dos attacked and stopped the server. but after several days whenever I start the server, similar log happens. I'm wondering if anyone know what is happening? is it caused by a virus?

23.19.76.217 - - [17/Oct/2012:10:21:47 -0400] "GET http://ad.globe7.com/st?ad_type=iframe&ad_size=728x90&section=3633732&pub_url=${PUB_URL} HTTP/1.0" 200 4497
142.54.177.114 - - [17/Oct/2012:10:21:47 -0400] "GET http://ad.globe7.com/imp?Z=300x250&s=3582878&T=3&_salt=3106601030&B=12&m=2&u=http%3A%2F%2Fwww.homesearchcar.com%2F%3Fp%3D184&r=1 HTTP/1.0" 302 -
share|improve this question
add comment

4 Answers

up vote 3 down vote accepted

Looks like you've accidentally configured an open proxy server, and the Internet found out about it.

So everyone and their mother is now using your server to proxy their web connections and hide what they're doing. In this particular case, your server is being used to abuse an ad network. You will be blamed for this.

Shut down your server as soon as possible, and reconfigure it to deny proxy access, or allow it only where it's absolutely necessary.

share|improve this answer
    
The downvote really needs an explanation. –  Michael Hampton Oct 17 '12 at 14:53
    
thanks, how to disable the open proxy server? –  Daniel Oct 17 '12 at 15:33
    
Click the link :) –  Michael Hampton Oct 17 '12 at 15:35
    
it's resolved, many thanks! –  Daniel Oct 17 '12 at 16:04
add comment

try to put this on your .htaccess

#-Prevent proxy access
#
RewriteEngine on
RewriteCond %{HTTP:VIA} !^$ [OR]
RewriteCond %{HTTP:FORWARDED} !^$ [OR]
RewriteCond %{HTTP:USERAGENT_VIA} !^$ [OR]
RewriteCond %{HTTP:X_FORWARDED_FOR} !^$ [OR]
RewriteCond %{HTTP:PROXY_CONNECTION} !^$ [OR]
RewriteCond %{HTTP:XPROXY_CONNECTION} !^$ [OR]
RewriteCond %{HTTP:HTTP_PC_REMOTE_ADDR} !^$ [OR]
RewriteCond %{HTTP:HTTP_CLIENT_IP} !^$
RewriteRule .* - [F]
#

and you will notice the 2nd to the last line on the log.

...732&pub_url=${PUB_URL} HTTP/1.0" 200 4497

becomes

...732&pub_url=${PUB_URL} HTTP/1.0" 404 4497
share|improve this answer
    
While this may work, he could simply disable the proxy functionality directly instead of using mod_rewrite as access control. Additionally, .htaccess files are to be avoided as they decrease performance and may also decrease security. –  Falcon Momot Jun 28 '13 at 7:11
add comment

I've just been hit by the same problem, and my server definitely wasn't running an open proxy - the requests were all hitting the default site, and this was overwhelming the database server. Looks like a badly written click-fraud botnet - it's trying to use open proxies but not checking if it's successful or not. I've seen requests from ~1,500 IP addresses, so blocking them isn't practical.

Adding this as the first (and therefore default) Virtual Host worked for me

<VirtualHost *:80>
  ServerName default.only
  <Location />
    Order allow,deny
    Deny from all
  </Location>
</VirtualHost>

(from http://wiki.apache.org/httpd/ProxyAbuse)

The variant which I was hit with was also requesting pages on these ad servers:

  • ad.adorika.com/
  • ad.adserverplus.com/
  • ads1.ministerial5.com/
  • ads.clovenetwork.com/
  • ads.creafi-online-media.com/
  • ad.tagjunction.com/
  • ax-d.pixfuture.net/
  • ib.adnxs.com/
  • www.mmadsgadget.com/
share|improve this answer
add comment

That doesn't look like a Virus, but really it's kind of hard for us to tell you much as we don't know what's "normal" traffic looks like... but either case if you think this is bad traffic then you should block it using build-in apache mechanism or there is always a firewall)

take a look at your script that're being called

http://ad.globe7.com/st
document.write("<span>Smart Tag Error: Malformed URL - ST_NO_AD_TYPE_GIVEN </span>");

http://ad.yieldmanager.com/imp?
// Invalid tag - code 1, Invalid size, entity=0

is this normal behavior? is this even yours?

share|improve this answer
    
Are you trying to answer the question or ask the user for more information? If the latter, you should post a comment. It doesn't appear that you know the answer to this question, so posting an answer is almost certainly not appropriate. –  Michael Hampton Oct 17 '12 at 14:54
    
I proposed block offender IPs (just like you) if this is not legitimate traffic, but its hard to know from outsider what's legitimate and whats not. your answer on the other hand I dont know how you determinate that this is open proxy... I host proxys and they dont produce lines such as this.. –  alexus Oct 17 '12 at 15:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.