Flood of traffic on port 25

Hrishi asked:

I am getting thousands of hits on port 25, over 400,000 connections in a day.

I am using sendmail default settings on Debian 7. Mailserver is not configured.

Please see below Nginx access logs

root@zone:/usr/local/nginx/logs# tail access.log
61.231.81.100 - - [12/Sep/2013:23:56:46 +0530] "CONNECT 203.188.197.111:25 HTTP/1.0" 400 172 "-" "-"
61.231.82.166 - - [12/Sep/2013:23:56:46 +0530] "CONNECT 27.123.206.55:25 HTTP/1.0" 400 172 "-" "-"
61.228.19.219 - - [12/Sep/2013:23:56:46 +0530] "CONNECT 203.188.197.111:25 HTTP/1.0" 400 172 "-" "-"
61.231.83.31 - - [12/Sep/2013:23:56:47 +0530] "CONNECT 114.34.96.143:25 HTTP/1.0" 400 172 "-" "-"
61.228.19.219 - - [12/Sep/2013:23:56:47 +0530] "CONNECT 203.188.197.119:25 HTTP/1.0" 400 172 "-" "-"
61.231.82.166 - - [12/Sep/2013:23:56:47 +0530] "CONNECT 27.123.206.55:25 HTTP/1.0" 400 172 "-" "-"
61.231.90.113 - - [12/Sep/2013:23:56:47 +0530] "CONNECT 27.123.206.55:25 HTTP/1.0" 400 172 "-" "-"
61.231.84.210 - - [12/Sep/2013:23:56:47 +0530] "CONNECT 203.188.197.111:25 HTTP/1.0" 400 172 "-" "-"
61.231.82.166 - - [12/Sep/2013:23:56:47 +0530] "CONNECT 203.188.197.111:25 HTTP/1.0" 400 172 "-" "-"
61.231.87.39 - - [12/Sep/2013:23:56:47 +0530] "CONNECT 27.123.206.55:25 HTTP/1.0" 400 172 "-" "-"

Now I have blocked entire subnet from Nginx

deny 61.231.0.0/16;
deny 61.228.0.0/16;

I am getting below access logs:

tail access.log
111.241.32.138 - - [13/Sep/2013:01:12:02 +0530] "GET http://www.google.com.tw/ HTTP/1.1" 403 570 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
111.241.32.138 - - [13/Sep/2013:01:12:02 +0530] "CONNECT mta7.am0.yahoodns.net:25 HTTP/1.0" 400 172 "-" "-"
184.75.210.226 - - [13/Sep/2013:01:12:38 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"
61.231.2.232 - - [13/Sep/2013:01:12:38 +0530] "GET http://www.google.co.jp HTTP/1.1" 403 570 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
61.231.2.232 - - [13/Sep/2013:01:12:39 +0530] "CONNECT mx3.mail2000.com.tw:25 HTTP/1.0" 400 172 "-" "-"
61.231.87.103 - - [13/Sep/2013:01:12:44 +0530] "GET http://www.google.com/intl/zh-CN/ HTTP/1.1" 403 570 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
61.231.87.103 - - [13/Sep/2013:01:12:45 +0530] "CONNECT mta5.am0.yahoodns.net:25 HTTP/1.0" 400 172 "-" "-"
61.231.83.158 - - [13/Sep/2013:01:12:55 +0530] "GET http://www.google.com.tw HTTP/1.1" 403 570 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
61.231.83.158 - - [13/Sep/2013:01:12:56 +0530] "CONNECT mx3.mail2000.com.tw:25 HTTP/1.0" 400 172 "-" "-"
61.228.22.143 - - [13/Sep/2013:01:13:09 +0530] "GET http://www.google.com/ HTTP/1.1" 403 570 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"

Blocked subnets from iptables, stopped getting traffic from those subnets.

-I INPUT -s 61.231.0.0/16 -j DROP
-I INPUT -s 111.241.0.0/16 -j DROP
-I INPUT -s 61.228.0.0/16 -j DROP
 tail access.log
78.40.124.16 - - [13/Sep/2013:02:53:39 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"
67.205.67.76 - - [13/Sep/2013:02:54:38 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"
46.165.195.139 - - [13/Sep/2013:02:55:39 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"
46.165.195.139 - - [13/Sep/2013:02:55:40 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"
174.34.162.242 - - [13/Sep/2013:02:56:38 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"
123.125.71.114 - - [13/Sep/2013:02:56:44 +0530] "GET / HTTP/1.1" 200 8553 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
220.181.108.153 - - [13/Sep/2013:02:56:55 +0530] "GET / HTTP/1.1" 200 23153 "-" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
95.141.32.46 - - [13/Sep/2013:02:57:38 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"
95.211.217.68 - - [13/Sep/2013:02:58:38 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"
91.109.115.41 - - [13/Sep/2013:02:59:38 +0530] "GET / HTTP/1.1" 200 8078 "-" "Pingdom.com_bot_version_1.4_(http://www.pingdom.com)"

I think, someone is using my server hostname or IP as SMTP?
Please suggest permanent remedy to resolve this issue, because since this is Client’s website and has global access, real user having accessing website from same subnet can be impacted.

How can I stop this?

My answer:


You’re not actually receiving traffic on port 25, but on port 80, via your web server.

This traffic is attempting to use your server as a proxy to disguise the origin of the traffic. We generally call such servers open proxies, and they’re quite useful for delivering spam and conducting attacks on other sites.

For some reason, some people seem to think your IP address has an open proxy server, but the log entries show that the requests are being refused.

If the volume of requests is too high, I would suggest firewalling off the IP address blocks rather than simply denying them in nginx. For instance:

iptables -I INPUT -s 61.231.0.0/16 -j DROP

View the full question and answer on Server Fault.

Creative Commons License
This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.