I have a linux apache server which was running fine until a few days ago. What happened is from the access log there are lines like this, and the log file is growing by many lines every second. Initially I suspected the server was dos attacked and stopped the server. but after several days whenever I start the server, similar log happens. I’m wondering if anyone know what is happening? is it caused by a virus?
23.19.76.217 - - [17/Oct/2012:10:21:47 -0400] "GET http://ad.globe7.com/st?ad_type=iframe&ad_size=728x90§ion=3633732&pub_url=${PUB_URL} HTTP/1.0" 200 4497
142.54.177.114 - - [17/Oct/2012:10:21:47 -0400] "GET http://ad.globe7.com/imp?Z=300x250&s=3582878&T=3&_salt=3106601030&B=12&m=2&u=http%3A%2F%2Fwww.homesearchcar.com%2F%3Fp%3D184&r=1 HTTP/1.0" 302 -
Looks like you’ve accidentally configured an open proxy server, and the Internet found out about it.
So everyone and their mother is now using your server to proxy their web connections and hide what they’re doing. In this particular case, your server is being used to abuse an ad network. You will be blamed for this.
Shut down your server as soon as possible, and reconfigure it to deny proxy access, or allow it only where it’s absolutely necessary.
Check more discussion of this question.
