1

I'm running a nodejs server with the express framework. I'm using Keymetrics.io to keep track of my app's status.

I have been keeping track of 500 and 404 errors and sending them to Keymetrics and the 404 errors show something strange I have not seen before, I hope someone can clear up what this exactly is.

Basically I keep getting these URL post requests every 2-3 minutes:

  • /V9vc4AAAA/JU70M/cUPBuAAA/
  • /QLId/1Mv30AAAA/lPVraBAAA/
  • /V9vc4AAAA/JU70M/cUPBuAAA/
  • /85V/xCAA/LamkyCA/3lMmCAAAAAA/
  • /BXiuX/AuNt/B/bjX/
  • /3GUYKAAAAAA/8xjakDAA/LnBQqDA/
  • /85V/xCAA/LamkyCA/3lMmCAAAAAA/
  • /Cbeo8A/DsZuoAA/BF3Zj/
  • /3GUYKAAAAAA/8xjakDAA/LnBQqDA/
  • /QLId/1Mv30AAAA/lPVraBAAA/

Obviously my server points them to a 404 page but does anyone know what this is? is it a bot? do I need to be aware of some vulnerability?

Some header examples of the requests

{ accept: '*/*',
'user-agent': 'Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)',
host: '109.235.76.136:8080',
'content-length': '701',
connection: 'Keep-Alive',
'cache-control': 'no-cache',
cookie: 'vacwatch=s%3Am_Rj28ASGR2gLNOoZT385QxXJTaPuGAp.7g89Wz41URpTiJSxQ8R8UaQgMRPUl94NNjruqluZR40' }

{ accept: '*/*',
'user-agent': 'Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)',
host: '109.235.76.136:8080',
'content-length': '677',
connection: 'Keep-Alive',
'cache-control': 'no-cache',
cookie: 'vacwatch=s%3AfdU50VdWoHd3jSmbbGKt4IXUTWvauxa4.OpRmN39XUis7sDkJrRtn83Uw%2FSo5VyJ1fZRcXT7HWH8' }

edit: The requests come from multiple different IP's

Improve this question
4
  • The cookie part is very interesting. Is that something your site sets? Is there a Referer field? Are you logging all requests or just errors?
    – Otheus
    May 7, 2015 at 23:36
  • @Otheus the cookie is set once you make a request to the website. It is expected behavior of the express framework. I'm just weirded out by the url and that it's a empty post request.
    – GiveMeAllYourCats
    May 8, 2015 at 1:02
  • @Otheus this is all the headers are showing me so no referer. I'm only logging 404 and 500 errors. It also should be noted the requests come from multiple different ip's
    – GiveMeAllYourCats
    May 8, 2015 at 1:14
  • Is the cookie value the one the server sends or the one it receives from the client? I assumed the latter. But if there is no referer field, and it's getting a different cookie each time, it's uh, above my head. (which doesnt happen often)
    – Otheus
    May 8, 2015 at 20:16

1 Answer 1

Reset to default
1

Wow. So yea. I figured out why these url's keep popping up on my 404 log.

I noticed a error today in my exception log that a email was rejected and not delivered. So I check the exact details of this error why the email could not be delivered: 550 This message was classified as SPAM and may not be delivered

So I check a blacklist check tool on the internet to check where I got blacklisted and why. And I got only one result saying i'm blacklisted by SPAMHAUS.

I go to there website and give my domain for a checkup and indeed. It confirms i'm on their 'Spamhaus Block List'

I click on my entry for further details about the block and this is what I see:

The host at this IP address is most likely compromised and 
running a malicious HTTP daemon (nginx) on port 8080 (TCP)
which is being used by cybercriminals to control computers
infected with a Trojan called Feodo.

Feodo botnet controller located here:
http://109.235.76.136:8080/QrdO/fknypBAAAAA/PHmnSCAAAAA/

Feodo is a sophisticated banking Trojan, used to commit 
ebanking fraud. More information about this Trojan can be 
found here: http://blog.fireeye.com/research/2010/10/feodosoff-a-new-botnet-on-the-rise.html

To get this issue solved, you need to locate and identify 
the malicious nginx daemon on the compromised server 
(likely located in a hidden directoy in the /tmp/ directory)
and remove it completely. To avoid that the server gets hacked again, please ensure that you change all SSH credentials (passwords) and that all installed software is up to date (including OS).

More information how you can secure your SSH daemon 
can be found here: http://www.spamhaus.org/faq/section/Generic%20Questions#362

I was confused, I have no nginx running so I check the date of the entry and it states 2013-11-14 18:39:31 GMT. So it seems the previous owner of this IP was infected with this botnet. Which basically keeps spamming these weird url post requests.

Improve this answer
6
  • 1
    Correcting link: fireeye.com/blog/threat-research/2010/10/…
    – Otheus
    May 8, 2015 at 20:19
  • Yeah, I was also curious about port 8080. Do you need help getting rid of this thing?
    – Otheus
    May 8, 2015 at 20:21
  • @Otheus no the previous owner of the ip was infected. I don't run nginx and the report is like 2-3 years old. I have now been removed from spamhaus blacklist
    – GiveMeAllYourCats
    May 8, 2015 at 22:30
  • 1
    Wow, that's really friggin' cool. So old owner gets infected, which then becomes a hub for receiving spam/hacker data from other infected hosts. They give up IP address (probably because no one accepted their email anymore) and you get it. You still see traffic from other infected bots. Just damn.
    – Otheus
    May 8, 2015 at 22:38
  • So I'd be a nice guy, filter the logs, sort out unique IPs, reverse DNS lookup, then whois, and contact each domain owner to let them know their PC is infected. But that's me. And because it would be a one-line shell script.
    – Otheus
    May 8, 2015 at 22:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .