3

this is what my web access.log looks like (well a short snippet)

46.4.33.46 - - [20/Jul/2011:11:56:18 +0100] "GET http://allegro.pl/matematyka-wokol-nas-6-zeszyt-cwiczen-czesc-1-2-i1727657348.html HTTP/1.0" 200 31161
78.159.125.176 - - [20/Jul/2011:11:56:17 +0100] "GET http://gotgirlspeeing.com/ HTTP/1.1" 200 110698
78.159.125.176 - - [20/Jul/2011:11:56:20 +0100] "GET http://gotgirlspeeing.com/js/search.js HTTP/1.1" 200 2842
184.173.219.98 - - [20/Jul/2011:11:56:59 +0100] "GET http://ads.lzjl.com/newServing/getkey.php?cb=getkey&ob=Yesup.infinityads.Code[0]&nid=5&pid=17587&sid=28749&spid=0&ns=0&nw=1&zone=0&url=http://www.mypaydayloan.com/&oe=ISO-8859-1&t3642160 HTTP/1.0" 200 762
208.115.238.200 - - [20/Jul/2011:11:59:45 +0100] "GET http://ad.xtendmedia.com/st?ad_type=iframe&ad_size=728x90&section=1697345 HTTP/1.0" 200 4580
1.197.203.145 - - [20/Jul/2011:11:59:45 +0100] "GET http://www.hardjob.net/proxyheader.php HTTP/1.0" 200 723
122.228.236.202 - - [20/Jul/2011:11:59:45 +0100] "GET http://ad.reduxmedia.com/st?ad_type=iframe&ad_size=728x90&section=755027 HTTP/1.0" 200 4574
59.45.185.14 - - [20/Jul/2011:11:59:45 +0100] "GET http://ads.clicksor.com/showAd.php?nid=1&pid=174828&adtype=&sid=270818 HTTP/1.0" 200 1489
221.215.112.238 - - [20/Jul/2011:11:59:45 +0100] "GET http://media.fastclick.net/w/get.media?sid=60107&tp=5&d=j&t=n HTTP/1.0" 302 280

My whole access.log is filled with lines like the above. Some including ebay links, some to car deals, some to porn. I really am lost in all of this, perhaps someone could offer some advice?

Since our logs started to look like this the server has really slowed down when it comes to serving pages, most of the time requests time out.

I'm guessing these things are related?

Many thanks,

Elliott

Improve this question

2 Answers 2

Reset to default
3

When you see a request which is for a remote URL you're seeing somebody either scanning for a proxy - testing to see if they can route traffic via your machine - or using one that is unlocked.

It looks like, from the status codes of 200 + 302, your machine is configured with Apache's mod_proxy, which means people are bouncing traffic around.

If you're not deliberately using mod_proxy you should disable it. If you are using it for some purpose you should tighten up security.

Improve this answer
2
  • Thank you for your quick reply Steve! When I disable mod_proxy I can no longer view my websites. Why would this be? I don't believe I should have a use for a proxy, so is there a way around it? I suppose this is the problem with Apple's "Hey just pick up a server today and anyone can run it"... Thanks again!
    – Elliott Malone
    Jul 20, 2011 at 12:04
  • I can't tell how you're using mod_proxy, but I do know it has a lot of security options. You should probably re-enable it only after reading: httpd.apache.org/docs/2.0/mod/mod_proxy.html
    – user9565
    Jul 20, 2011 at 13:16
0

In addition to Steves answer you could check Is my server being used as a proxy or is a DOS underway? Lots of traffic in my apache log - as pointed out there your IP might have previously used by a botnet.

Improve this answer
2
  • Strangely enough this did start happening when we changed our IP address... That's a tad worrying.
    – Elliott Malone
    Jul 20, 2011 at 12:07
  • Probably not as much as if your system itself had been hacked. Maybe requesting a "clean" IP address from your provider will solve the issue.
    – Filburt
    Jul 21, 2011 at 8:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .