1

I just booted a new, mint Debian Squeeze x64 server from my cloud hosting provider. I received by root password by email, logged in and ran the following commands:

apt-get update apt-get upgrade apt-get install apache2

After waiting a couple minutes, this is what I see in my Apache logs:

$ tail -f /var/log/apache2/access.log
142.0.136.91 - - [14/Apr/2013:17:24:57 +0000] "GET http://ib.adnxs.com/ttj?id=1203788&size=120x600 HTTP/1.0" 404 520 "http://www.axmoviereviews.com/?p=93" "Mozilla/4.61 (Macintosh; I; PPC)"

23.19.26.22 - - [14/Apr/2013:17:24:57 +0000] "GET http://ads1.ministerial5.com/creative/2-002134487-00001j;size=2 HTTP/1.0" 404 560 "://www.bigmoonman.com/index.php?view=article&catid=34%3Acredit-cards&id=147%3A2012-11-04-20-21-54&tmpl=component&print=1&layout=default&page=&option=com_content&Itemid=53" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Alexa Toolbar)"
142.4.97.29 - - [14/Apr/2013:17:24:57 +0000] "GET http://ib.adnxs.com/ttj?id=1187354 HTTP/1.0" 404 520 "http://www.axtourism.com/index.php?view=article&catid=38:tourism-studies&id=2001:2012-08-11-23-06-15&format=pdf" "Mozilla/4.61 [en] (WinNT; I)"
142.4.127.44 - - [14/Apr/2013:17:24:57 +0000] "GET http://ads.yashi.com/2382/ HTTP/1.0" 404 523 "http://www.today-entertainment.com/?p=25" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.814.0 Safari/535.1"
192.0.17.59 - - [14/Apr/2013:17:24:57 +0000] "GET http://ib.adnxs.com/ttj?id=1150137 HTTP/1.0" 404 520 "http://www.keelm.com/car-finance-advice/buying-cars-on-finance-your-questions-answered.html" "Opera/9.80 (S60; SymbOS; Opera Tablet/9174; U; en) Presto/2.7.81 Version/10.5"
108.62.42.19 - - [14/Apr/2013:17:24:57 +0000] "GET http://ads1.ministerial5.com/creative/2-002134228-00001j;size=4 HTTP/1.0" 404 560 "http://earthmouth.com/index.php?option=com_content&view=article&id=5839:2012-10-02-14-13-13&catid=35:journey-wiki&Itemid=54" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040626 Firefox/0.8"
174.34.140.155 - - [14/Apr/2013:17:24:58 +0000] "GET http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250&section=4270745&pub_url=${PUB_URL} HTTP/1.0" 404 526 "http://touristforce.com/index.php/tourist-guide/1864-part-time-tourist-guide-job-london--job-requirements/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; MAXTHON 2.0)"
173.208.85.13 - - [14/Apr/2013:17:24:58 +0000] "GET http://ib.adnxs.com/ttj?id=1273606 HTTP/1.0" 404 520 "http://womenorange.com/index.php?option=com_content&view=article&id=13682:2011-12-14-21-50-00&catid=42:womens-health-diet&Itemid=98" "Opera/9.80 (Windows NT 5.1; U; en) Presto/2.9.168 Version/11.51"
64.31.36.235 - - [14/Apr/2013:17:24:58 +0000] "GET http://ad.globe7.com/st?ad_type=iframe&ad_size=160x600&section=3698931&pub_url=${PUB_URL} HTTP/1.0" 404 520 "http://www.mortcard.com/html/what-is-considered-a-good-credit-score.html" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01"
69.162.82.53 - - [14/Apr/2013:17:24:58 +0000] "GET http://ib.adnxs.com/tt?id=1180784&cb=${CACHEBUSTER}&pubclick=${CLICK_URL} HTTP/1.0" 404 519 "http://www.voguewow.com/index.php?option=com_content&view=article&id=2593:sleep-apnea-and-weight-loss-surgery&catid=52:weight-loss&Itemid=144" "Mozilla/3.0 WebTV/1.2 (compatible; MSIE 2.0)"
...

As you can imagine, this is scrolling at rather high speed.

So, what's the verdict? Is there a security flaw inside the Debian distribution installed by my hosting provider?

(As long as I am not sure it is indeed a security issue that stems from the hosting provider distribution I'd rather not give out its name)

Improve this question

3 Answers 3

Reset to default
4

Someone has been using your VPS's IP address as a proxy to abuse the various ad networks shown here. If you just got the thing, it was probably whoever last had the IP address running an open proxy.

If I ran into this situation, I would shut down the web server, and then contact the provider to let them know of the issue and ask for a different IP address.

Improve this answer
2
  • Diagnosis is correct (in this case it's just a botnet trying to carry out clickfraud - remediation is wrong. Changing your IP address is unlikely to have any impact.
    – symcbean
    Apr 17, 2013 at 9:45
  • @symcbean Care to elaborate? Without a really good explanation, I have to disagree changing the IP address is useless.
    – Michael Hampton
    Apr 17, 2013 at 14:22
4

All the requests are having a 404 (file not found) response, so it looks like you are under some kind of botnet attack, quite frequent in this VPS.

So first off:

# service apache2 stop

Afterwards. install and configure fail2ban. That should, at a very least, give you some protection. There is documentation online regarding the use of mod_rewrite to drop some of this crap.

Improve this answer
0

If you look at the urls, it all seems advertisements/banner. I think your service provider give you a old AdServer IP. You can ask for new one and hope it is not used.

I think it will be a waste of bandwidth/cpu if you keep this IP and try to block some way.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .