I have a CentOS 5.8 server with Apache 2.2.3 with 20 websites on it. The last weeks the server was several times inaccessible (too many database connections and lots of CPU usage). I had to restart the server again to get ssh/ftp/http access again. When I checked the httpd log files of the server I see 10.000 'access attempts' every day coming via yourthumbnails.com. Here an example of the access log: - - [19/Apr/2012:14:20:06 +0200] 
"GET /yourthumbnails.com/?id=2&%20121 HTTP/1.1" 404 278 "http://yourthumbnails.com/tgp44.html" 
"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; GTB7.1; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30618; WinNT-PAI 23.10.2009)"

And the error log

[Thu Apr 19 14:19:15 2012] [error] [client] 
File does not exist: /var/www/vhosts/default/htdocs/yourthumbnails.com, referer: 

As you can see yourthumbnails.com is the referrer and the actual visitors all have different ip adresses. So I'm not able to block just one ip address.

I've searched Google how to block a referrer, but that seems to be very difficult. One method is to do it via htaccess like this:

RewriteEngine on
# Options +FollowSymlinks
RewriteCond %{HTTP_REFERER} ^http://(www\.)?yourthumbnails\.com
RewriteRule .* - [F]

However, I looked in the individual httpd access log of all my sites and can't find one where yourhtumbnails is in. So it looks like my server is being attacked directly? And I can't use the htaccess method.

My question: Is there a way to block this kind of 'referrer attack' on the server without using a lot of server resources?

I've contacted my provider and even they can't come up with a solution. So I would be very happy if someone here has an idea.


I looked in the individual httpd access log of all my sites and can't find one where yourhtumbnails is in

But is being reported in the error log. Looks like you're just not writing referer to the access log.

However it doesn't solve the problem you are describing - the request you show is causing a 404 response - this should not result in lots of database connections (unless you've got some smarts in the 404 handler), it should require a lot less effort for the webserver to handle this than to handle a valid request.

So either there's other stuff going on which you've not told us about or you'll need to handle these above the httpd (e.g. with a fail2ban rule, syn rate limiting in iptables). You probably want to get in touch with the poeple running thumbnails.com too.

  • You're probably right. I thought this caused the system overload... Drawn the wrong conclusion. I'll check other logs to see if I can find a cause. Thanks for your answer. – user1343955 Apr 19 '12 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy