# Logs show massive spam of "proxy.php" access

**URL:** <https://www.ruby-forum.com/t/logs-show-massive-spam-of-proxy-php-access/235794>\
**Category:** NGINX\
**Created:** [July 16, 2013, 4:35pm UTC](https://www.ruby-forum.com/t/logs-show-massive-spam-of-proxy-php-access/235794 "2013-07-16T16:35:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![addis\_a](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/c4cdca/32.png) [@addis\_a](https://www.ruby-forum.com/u/addis_a)\
**Post date:** [July 16, 2013, 4:35pm UTC](https://www.ruby-forum.com/t/logs-show-massive-spam-of-proxy-php-access/235794/1 "2013-07-16T16:35:03Z")

</div>

Hello,

since I have installed nxginx on my Ubuntu LTS, I see the logs  
absolutely  
full of text like this:

2013/07/16 11:07:43 [error] 24590#0: \*445 rewrite or internal  
redirection  
cycle while internally redirecting to “/index.php”, client:  
91.237.249.99,  
server: www.[my host name].com, request: “POST  
[http://50.56.191.147/~cashcorp/proxies/engine.php](http://50.56.191.147/~cashcorp/proxies/engine.php) HTTP/1.0”, host:  
“50.56.191.147”, referrer:  
“[http://50.56.191.147/~cashcorp/proxies/engine.php](http://50.56.191.147/~cashcorp/proxies/engine.php)”

2013/07/16 11:09:23 [error] 24590#0: \*449 rewrite or internal  
redirection  
cycle  
while internally redirecting to “/index.php”, client: 89.69.13.95,  
server:  
www.[my host name].com, request: “POST  
[http://discountbaby63.ru/proxyc/engine.php](http://discountbaby63.ru/proxyc/engine.php) HTTP/1.0”, host:  
“[discountbaby63.ru](http://discountbaby63.ru)”, referrer:  
“[http://discountbaby63.ru/proxyc/engine.php](http://discountbaby63.ru/proxyc/engine.php)”

2013/07/16 11:10:29 [error] 24590#0: \*453 rewrite or internal  
redirection  
cycle while internally redirecting to “/index.php”, client:  
142.4.98.163,  
server: [www.fleurworld.com](http://www.fleurworld.com), request: “POST  
[http://spamstats.net/proxyc/engine.php](http://spamstats.net/proxyc/engine.php) HTTP/1.0”, host: “[spamstats.net](http://spamstats.net)”,  
referrer: “[http://spamstats.net/proxyc/engine.php](http://spamstats.net/proxyc/engine.php)”

Is this an issue due to mis-configuration? Are they hackers? Are they  
succeeding at their hacking?

Posted at Nginx Forum:

> **[logs show massive spam of "proxy.php" access](https://forum.nginx.org/read.php?2,240914,240914#msg-240914)**
>
> Hello, since I have installed nxginx on my Ubuntu LTS, I see the logs absolutely full of text like this: 2013/07/16 11:07:43 \[error\] 24590#0: \*445 rewrite or internal redirection cycle while internally redirecting to "/index.php", client:...

---

<div class="post-metadata">

**Author:** ![dfumagalli](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/7993a0/32.png) [@dfumagalli](https://www.ruby-forum.com/u/dfumagalli)\
**Post date:** [July 16, 2013, 7:50pm UTC](https://www.ruby-forum.com/t/logs-show-massive-spam-of-proxy-php-access/235794/2 "2013-07-16T19:50:53Z")

</div>

On Tue, Jul 16, 2013 at 10:34:17AM -0400, dfumagalli wrote:

Hi there,

> since I have installed nxginx on my Ubuntu LTS, I see the logs absolutely  
> full of text like this:
> 
> 2013/07/16 11:07:43 [error] 24590#0: \*445 rewrite or internal redirection  
> cycle while internally redirecting to “/index.php”, client: 91.237.249.99,  
> server: www.[my host name].com, request: “POST  
> [http://50.56.191.147/~cashcorp/proxies/engine.php](http://50.56.191.147/~cashcorp/proxies/engine.php) HTTP/1.0”, host:  
> “50.56.191.147”, referrer:  
> “[http://50.56.191.147/~cashcorp/proxies/engine.php](http://50.56.191.147/~cashcorp/proxies/engine.php)”

It looks like the client is trying to use you as a proxy server, and  
you have a config problem which leads to this cycle mentioned in your  
error log.

There’s no obvious mention of the proxy.php in your Subject: line,  
though.

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)