Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a apache2 virtual host configured but I suffer a attack with thousands or request like "POST http://check2.zennolab.com/proxy.php HTTP/1.1" 200 115 "GET http://hartford.craigslist.org/fuo/3293382678.html HTTP/1.1" 200 2223

anybody knows what kind of attack is this? how I do to prevent?

EDIT:

Warning

Do not enable proxying with ProxyRequests until you have secured your server. Open proxy servers are dangerous both to your network and to the Internet at large.

of course it had enabled

share|improve this question
    
sounds like abuse of an open proxy. why do you have that proxy.php sitting there publicly accessible, does it need to be like that? –  user16081 Nov 7 '12 at 21:01
    
Same IP address or different ones? If it's the same, or a small number of IPs, iptables FTW. –  HopelessN00b Nov 7 '12 at 21:43
    
differents IP and differents GET and POST sources –  fphilip Nov 8 '12 at 8:03
add comment

2 Answers

This looks like an attack by some malicious user (or infected PC or botnet or whatever) that is now trying to find out if your machine has public available proxy features. If you had a real open proxy running there, the attacker could successfully hide behind your IP address. Don't worry though, those scans are fully automated and not against your host only and finally they will move on.

I suggest you wait for the scan to end if it doesn't affect your own service or just firewall out the requesting IP address/net.

// edited: I misunderstood the proxy.php part as if you would be hosting a page namend proxy.php yourself. See the comments.

share|improve this answer
1  
The HTTP request pasted by the OP includes a full URL, so I'm not entirely sure that he really has such a proxy.php file on his own server – in fact, he probably doesn't. I'm not sure how exactly Apache is handling that request. –  pino42 Nov 7 '12 at 21:41
    
@pino42 - You are right, my bad. Anyhow, this is definitely some kind of automated proxy scanning. I don't know exactly how apache handles this either but I would bet that the intent is to find out about forwarding capabilities of the posters host. So the advice of firewalling out whoever sends these requests keeps the same. –  Karma Fusebox Nov 7 '12 at 21:52
add comment

It would be interesting to understand what Apache is doing in those cases – is it really acting as a proxy? If it is, you should disable that. You can find a similar case discussed in this question.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.