Spam in Apache access logs

Régis B. asked:

I just booted a new, mint Debian Squeeze x64 server from my cloud hosting provider. I received by root password by email, logged in and ran the following commands:

apt-get update
apt-get upgrade
apt-get install apache2

After waiting a couple minutes, this is what I see in my Apache logs:

$ tail -f /var/log/apache2/access.log
142.0.136.91 - - [14/Apr/2013:17:24:57 +0000] "GET http://ib.adnxs.com/ttj?id=1203788&size=120x600 HTTP/1.0" 404 520 "http://www.axmoviereviews.com/?p=93" "Mozilla/4.61 (Macintosh; I; PPC)"

23.19.26.22 - - [14/Apr/2013:17:24:57 +0000] "GET http://ads1.ministerial5.com/creative/2-002134487-00001j;size=2 HTTP/1.0" 404 560 "://www.bigmoonman.com/index.php?view=article&catid=34%3Acredit-cards&id=147%3A2012-11-04-20-21-54&tmpl=component&print=1&layout=default&page=&option=com_content&Itemid=53" "Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Alexa Toolbar)"
142.4.97.29 - - [14/Apr/2013:17:24:57 +0000] "GET http://ib.adnxs.com/ttj?id=1187354 HTTP/1.0" 404 520 "http://www.axtourism.com/index.php?view=article&catid=38:tourism-studies&id=2001:2012-08-11-23-06-15&format=pdf" "Mozilla/4.61 [en] (WinNT; I)"
142.4.127.44 - - [14/Apr/2013:17:24:57 +0000] "GET http://ads.yashi.com/2382/ HTTP/1.0" 404 523 "http://www.today-entertainment.com/?p=25" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.814.0 Safari/535.1"
192.0.17.59 - - [14/Apr/2013:17:24:57 +0000] "GET http://ib.adnxs.com/ttj?id=1150137 HTTP/1.0" 404 520 "http://www.keelm.com/car-finance-advice/buying-cars-on-finance-your-questions-answered.html" "Opera/9.80 (S60; SymbOS; Opera Tablet/9174; U; en) Presto/2.7.81 Version/10.5"
108.62.42.19 - - [14/Apr/2013:17:24:57 +0000] "GET http://ads1.ministerial5.com/creative/2-002134228-00001j;size=4 HTTP/1.0" 404 560 "http://earthmouth.com/index.php?option=com_content&view=article&id=5839:2012-10-02-14-13-13&catid=35:journey-wiki&Itemid=54" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040626 Firefox/0.8"
174.34.140.155 - - [14/Apr/2013:17:24:58 +0000] "GET http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250&section=4270745&pub_url=${PUB_URL} HTTP/1.0" 404 526 "http://touristforce.com/index.php/tourist-guide/1864-part-time-tourist-guide-job-london--job-requirements/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; MAXTHON 2.0)"
173.208.85.13 - - [14/Apr/2013:17:24:58 +0000] "GET http://ib.adnxs.com/ttj?id=1273606 HTTP/1.0" 404 520 "http://womenorange.com/index.php?option=com_content&view=article&id=13682:2011-12-14-21-50-00&catid=42:womens-health-diet&Itemid=98" "Opera/9.80 (Windows NT 5.1; U; en) Presto/2.9.168 Version/11.51"
64.31.36.235 - - [14/Apr/2013:17:24:58 +0000] "GET http://ad.globe7.com/st?ad_type=iframe&ad_size=160x600&section=3698931&pub_url=${PUB_URL} HTTP/1.0" 404 520 "http://www.mortcard.com/html/what-is-considered-a-good-credit-score.html" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; de) Opera 11.01"
69.162.82.53 - - [14/Apr/2013:17:24:58 +0000] "GET http://ib.adnxs.com/tt?id=1180784&cb=${CACHEBUSTER}&pubclick=${CLICK_URL} HTTP/1.0" 404 519 "http://www.voguewow.com/index.php?option=com_content&view=article&id=2593:sleep-apnea-and-weight-loss-surgery&catid=52:weight-loss&Itemid=144" "Mozilla/3.0 WebTV/1.2 (compatible; MSIE 2.0)"
...

As you can imagine, this is scrolling at rather high speed.

So, what’s the verdict? Is there a security flaw inside the Debian distribution installed by my hosting provider?

(As long as I am not sure it is indeed a security issue that stems from the hosting provider distribution I’d rather not give out its name)

My answer:


Someone has been using your VPS’s IP address as a proxy to abuse the various ad networks shown here. If you just got the thing, it was probably whoever last had the IP address running an open proxy.

If I ran into this situation, I would shut down the web server, and then contact the provider to let them know of the issue and ask for a different IP address.


View the full question and answer on Server Fault.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.