Take the 2-minute tour ×

I have a linux apache server which was running fine until a few days ago. What happened is from the access log there are lines like this, and the log file is growing by many lines every second. Initially I suspected the server was dos attacked and stopped the server. but after several days whenever I start the server, similar log happens. I'm wondering if anyone know what is happening? is it caused by a virus? - - [17/Oct/2012:10:21:47 -0400] "GET http://ad.globe7.com/st?ad_type=iframe&ad_size=728x90&section=3633732&pub_url=${PUB_URL} HTTP/1.0" 200 4497 - - [17/Oct/2012:10:21:47 -0400] "GET http://ad.globe7.com/imp?Z=300x250&s=3582878&T=3&_salt=3106601030&B=12&m=2&u=http%3A%2F%2Fwww.homesearchcar.com%2F%3Fp%3D184&r=1 HTTP/1.0" 302 -
share|improve this question

4 Answers 4

up vote 5 down vote accepted

Looks like you've accidentally configured an open proxy server, and the Internet found out about it.

So everyone and their mother is now using your server to proxy their web connections and hide what they're doing. In this particular case, your server is being used to abuse an ad network. You will be blamed for this.

Shut down your server as soon as possible, and reconfigure it to deny proxy access, or allow it only where it's absolutely necessary.

share|improve this answer
The downvote really needs an explanation. –  Michael Hampton Oct 17 '12 at 14:53
it's resolved, many thanks! –  Daniel Oct 17 '12 at 16:04

try to put this on your .htaccess

#-Prevent proxy access
RewriteEngine on
RewriteCond %{HTTP:VIA} !^$ [OR]
RewriteCond %{HTTP:FORWARDED} !^$ [OR]
RewriteCond %{HTTP:USERAGENT_VIA} !^$ [OR]
RewriteCond %{HTTP:X_FORWARDED_FOR} !^$ [OR]
RewriteCond %{HTTP:HTTP_PC_REMOTE_ADDR} !^$ [OR]
RewriteCond %{HTTP:HTTP_CLIENT_IP} !^$
RewriteRule .* - [F]

and you will notice the 2nd to the last line on the log.

...732&pub_url=${PUB_URL} HTTP/1.0" 200 4497


...732&pub_url=${PUB_URL} HTTP/1.0" 404 4497
share|improve this answer
While this may work, he could simply disable the proxy functionality directly instead of using mod_rewrite as access control. Additionally, .htaccess files are to be avoided as they decrease performance and may also decrease security. –  Falcon Momot Jun 28 '13 at 7:11

I've just been hit by the same problem, and my server definitely wasn't running an open proxy - the requests were all hitting the default site, and this was overwhelming the database server. Looks like a badly written click-fraud botnet - it's trying to use open proxies but not checking if it's successful or not. I've seen requests from ~1,500 IP addresses, so blocking them isn't practical.

Adding this as the first (and therefore default) Virtual Host worked for me

<VirtualHost *:80>
  ServerName default.only
  <Location />
    Order allow,deny
    Deny from all

(from http://wiki.apache.org/httpd/ProxyAbuse)

The variant which I was hit with was also requesting pages on these ad servers:

  • ad.adorika.com/
  • ad.adserverplus.com/
  • ads1.ministerial5.com/
  • ads.clovenetwork.com/
  • ads.creafi-online-media.com/
  • ad.tagjunction.com/
  • ax-d.pixfuture.net/
  • ib.adnxs.com/
  • www.mmadsgadget.com/
share|improve this answer

That doesn't look like a Virus, but really it's kind of hard for us to tell you much as we don't know what's "normal" traffic looks like... but either case if you think this is bad traffic then you should block it using build-in apache mechanism or there is always a firewall)

take a look at your script that're being called

document.write("<span>Smart Tag Error: Malformed URL - ST_NO_AD_TYPE_GIVEN </span>");

// Invalid tag - code 1, Invalid size, entity=0

is this normal behavior? is this even yours?

share|improve this answer
Are you trying to answer the question or ask the user for more information? If the latter, you should post a comment. It doesn't appear that you know the answer to this question, so posting an answer is almost certainly not appropriate. –  Michael Hampton Oct 17 '12 at 14:54
I proposed block offender IPs (just like you) if this is not legitimate traffic, but its hard to know from outsider what's legitimate and whats not. your answer on the other hand I dont know how you determinate that this is open proxy... I host proxys and they dont produce lines such as this.. –  alexus Oct 17 '12 at 15:04

Your Answer


