2

I have an apache server that was misconfigured and left as an open proxy for a week. A bunch of requests for forwarding pay-per-click advertising started streaming in and using our server.

This behaviour has been rectified and the server is no longer an open proxy.
The requests are still coming in by the truckload, and now they're being served with a 404 response.

The spammers code probably isn't checking the return codes so I'm not sure what the best approach is to get this traffic to go away.

In your experience is a best to send 404's / 500's? No response? Shut the server down for a few days? Is there a service to report the originating IPs to?

Am I now stuck with these requests until the spammers computers gets confiscated by the NSA, and therefore best to change the port or ask our ISP to give us a new IP address?

Edit

After 23 days of serving 404's the traffic has finally calmed down from about 10 queries/second to about 1 query every 15 seconds.

2

I had something similar. I opted for the unconventional solution of tailing the logs for the obviously bad requests, and dropping them in iptables. If anything, I was hoping the scripts were written synchronously, so they'd wait for a response before moving onto the next server - and by not giving a response at all, this would slow down their progress and remove the servers IP faster.

In actual fact, I don't know if it helped, but within a week 90% of the requests were gone. (I checked for the script, but I've mislaid it, sorry).

In response to your specific questions:

  • If the traffic doesn't bother you (i.e. you can easily aborb it) it might be worth just waiting it out
  • I'd never shut the server/service down
  • You probably can report the IPs, but trust me, it's a colossal waste of time. Very little will be done about it

If you find you're being spammed from a very specific set of IPs, just block them in your firewall. In my case, I appeared to have some kind of botnet against me, so I had to automate the solution out.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.