# Some sort of attack? **URL:** \ **Category:** NGINX\ **Created:** [March 16, 2013, 10:35am UTC](https://www.ruby-forum.com/t/some-sort-of-attack/227474 "2013-03-16T10:35:01Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Praveen\_Yarlagadda](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b4bc9f/32.png) [@Praveen\_Yarlagadda](https://www.ruby-forum.com/u/Praveen_Yarlagadda)\ **Post date:** [March 16, 2013, 10:35am UTC](https://www.ruby-forum.com/t/some-sort-of-attack/227474/1 "2013-03-16T10:35:01Z")
Hi, I installed nginx on an EC2 instance. After few hours, I started getting repeated requests from a set of servers. I tried using limit\_req with the following options: limit\_req\_zone $binary\_remote\_addr zone=ratezone:10m rate=3r/s; limit\_req zone=ratezone burst=5 nodelay; But I found that it is not effective. If you take a look at the following access\_log content, you would notice that the IP addresses are different. I don’t see more than 3 requests in a sec. Another weird thing is GET requests are starting with \*“http://”. \*I never saw it before. Is there any way I can filter requests or possibly throw 503? Any help is really appreciated. 108.62.157.221 - - [16/Mar/2013:06:48:32 +0000] “GET [http://ad.tagjunction.com/st?ad\_type=iframe&ad\_size=728x90§ion=3127172&pub\_url=${PUB\_URL}HTTP/1.0](http://ad.tagjunction.com/st?ad_type=iframe&ad_size=728x90§ion=3127172&pub_url=$%7BPUB_URL%7DHTTP/1.0)” 404 570 " [http://www.oslims.com/green-coffee/pure-coffee/why-should-you-buy-a-professional-coffee-maker.html](http://www.oslims.com/green-coffee/pure-coffee/why-should-you-buy-a-professional-coffee-maker.html)" “Mozilla/4.0 (compatible; MSIE 6.01; Windows 95; Alexa Toolbar)” “-” 108.62.192.236 - - [16/Mar/2013:06:48:32 +0000] “GET [http://ads1.ministerial5.com/creative/2-002134604-00001i;size=1](http://ads1.ministerial5.com/creative/2-002134604-00001i;size=1) HTTP/1.0” 404 570 " [http://femalefashionroad.com/index.php?option=com\_mailto&tmpl=component&link=aHR0cDovL2ZlbWFsZWZhc2hpb25yb2FkLmNvbS9pbmRleC5waHA/b3B0aW9uPWNvbV9jb250ZW50JnZpZXc9YXJ0aWNsZSZpZD0xOTYyNzoyMDExLTEyLTE1LTIyLTA5LTE3JmNhdGlkPTQxOndvbWVuLWZhc2hpb24mSXRlbWlkPTk3](http://femalefashionroad.com/index.php?option=com_mailto&tmpl=component&link=aHR0cDovL2ZlbWFsZWZhc2hpb25yb2FkLmNvbS9pbmRleC5waHA/b3B0aW9uPWNvbV9jb250ZW50JnZpZXc9YXJ0aWNsZSZpZD0xOTYyNzoyMDExLTEyLTE1LTIyLTA5LTE3JmNhdGlkPTQxOndvbWVuLWZhc2hpb24mSXRlbWlkPTk3)" “Mozilla/4.0 (compatible; MSIE 4.01; Windows 95)” “-” 173.208.16.212 - - [16/Mar/2013:06:48:32 +0000] “GET [http://ib.adnxs.com/ttj?id=1184170](http://ib.adnxs.com/ttj?id=1184170) HTTP/1.0” 404 570 " [FfWoman.com is for sale | HugeDomains](http://ffwoman.com/index.php?option=com_content&view=article&id=1358:face-cream-nearly-killed-a-woman&catid=54:health-tips&Itemid=100)" “Mozilla/5.0 (X11; U; Linux x86\_64; en-US) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.20 Safari/535.1” “-” 173.234.116.220 - - [16/Mar/2013:06:48:32 +0000] “GET [http://ad.globe7.com/st?ad\_type=pop&ad\_size=0x0§ion=2978145&banned\_pop\_types=29&pop\_times=1&pop\_frequency=0&pop\_nofreqcap=1HTTP/1.0](http://ad.globe7.com/st?ad_type=pop&ad_size=0x0§ion=2978145&banned_pop_types=29&pop_times=1&pop_frequency=0&pop_nofreqcap=1HTTP/1.0)” 404 570 " [http://www.economysea.com/index.php?option=com\_content&view=article&id=7067:2011-09-28-20-11-07&catid=48:economy-today&Itemid=98](http://www.economysea.com/index.php?option=com_content&view=article&id=7067:2011-09-28-20-11-07&catid=48:economy-today&Itemid=98)" “Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/535.11 (KHTML, like Gecko) Ubuntu/11.04 Chromium/17.0.963.65 Chrome/17.0.963.65 Safari/535.11” “-” 72.52.75.73 - - [16/Mar/2013:06:48:32 +0000] “GET [http://ib.adnxs.com/tt?id=1121510&cb=${CACHEBUSTER}&pubclick=${CLICK\_URL}HTTP/1.0](http://ib.adnxs.com/tt?id=1121510&cb=$%7BCACHEBUSTER%7D&pubclick=$%7BCLICK_URL%7DHTTP/1.0)” 404 570 " [http://www.tvzhou.com/?tag=lisa&paged=2](http://www.tvzhou.com/?tag=lisa&paged=2)" “Mozilla/5.0 (Windows NT 6.1) AppleWebKit/535.2 (KHTML, like Gecko) Chrome/18.6.872.0 Safari/535.2 UNTRUSTED/1.0 3gpp-gba UNTRUSTED/1.0” “-” 23.19.67.56 - - [16/Mar/2013:06:48:32 +0000] “GET [http://ad.tagjunction.com/st?ad\_type=iframe&ad\_size=120x600§ion=3680802&pub\_url=${PUB\_URL}HTTP/1.0](http://ad.tagjunction.com/st?ad_type=iframe&ad_size=120x600§ion=3680802&pub_url=$%7BPUB_URL%7DHTTP/1.0)” 404 168 " [http://economicface.com/index.php?option=com\_mailto&tmpl=component&link=e3ca08bc42ab0d0829e79ecb01f98523fba42f8b](http://economicface.com/index.php?option=com_mailto&tmpl=component&link=e3ca08bc42ab0d0829e79ecb01f98523fba42f8b)" “Mozilla/5.0 (Windows; U; WinNT3.51; en-US; rv:1.8.1.7) Gecko/20070914 Firefox/2.0.0.7” “-” 173.234.145.205 - - [16/Mar/2013:06:48:32 +0000] “GET [http://ad.globe7.com/st?ad\_type=iframe&ad\_size=728x90§ion=4097260&pub\_url=${www.classidressing.com}HTTP/1.0](http://ad.globe7.com/st?ad_type=iframe&ad_size=728x90§ion=4097260&pub_url=$%7Bwww.classidressing.com%7DHTTP/1.0)” 404 570 " [http://classidressing.com/index.php?view=article&catid=43:womens-clothing&id=7161:2012-01-19-23-59-09&format=pdf](http://classidressing.com/index.php?view=article&catid=43:womens-clothing&id=7161:2012-01-19-23-59-09&format=pdf)" “Mozilla/4.0 (compatible; MSIE 5.01; Windows 95; MSIECrawler)” “-” 142.4.126.137 - - [16/Mar/2013:06:48:32 +0000] “GET [http://ads.clovenetwork.com/ttj?id=801591&pubclick=[INSERT\_CLICK\_TAG]HTTP/1.0](http://ads.clovenetwork.com/ttj?id=801591&pubclick=%5BINSERT_CLICK_TAG%5DHTTP/1.0)” 404 570 " [http://www.today-car.com/?cat=601](http://www.today-car.com/?cat=601)" “Mozilla/4.0 (compatible; MSIE 6.0; Update a; Win32)” “-” 23.19.130.109 - - [16/Mar/2013:06:48:32 +0000] “GET [http://ads1.ministerial5.com/creative/2-002134516-00001i;size=2](http://ads1.ministerial5.com/creative/2-002134516-00001i;size=2) HTTP/1.0” 500 594 " [http://likecatpink.com/index.php?option=com\_content&view=article&id=10082:2012-01-07-14-12-06&catid=43:fashion-jewellery&Itemid=99](http://likecatpink.com/index.php?option=com_content&view=article&id=10082:2012-01-07-14-12-06&catid=43:fashion-jewellery&Itemid=99)" “Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 4.0; Alexa Toolbar)” “-” 108.62.17.245 - - [16/Mar/2013:06:48:32 +0000] “GET [http://ib.adnxs.com/ttj?id=1200348&cb=${CACHEBUSTER}&pubclick=${CLICK\_URL}HTTP/1.0](http://ib.adnxs.com/ttj?id=1200348&cb=$%7BCACHEBUSTER%7D&pubclick=$%7BCLICK_URL%7DHTTP/1.0)” 404 168 " [http://styleear.com/index.php?option=com\_mailto&tmpl=component&link=5d2f4abeb642b19272252d653174f14589e07a8b](http://styleear.com/index.php?option=com_mailto&tmpl=component&link=5d2f4abeb642b19272252d653174f14589e07a8b)" “Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko/20040626 Firefox/0.8” “-” -Praveen ---
**Author:** ![Praveen\_Yarlagadda](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b4bc9f/32.png) [@Praveen\_Yarlagadda](https://www.ruby-forum.com/u/Praveen_Yarlagadda)\ **Post date:** [March 16, 2013, 11:39am UTC](https://www.ruby-forum.com/t/some-sort-of-attack/227474/2 "2013-03-16T11:39:17Z")
On Sat, Mar 16, 2013 at 02:34:32AM -0700, Praveen Yarlagadda wrote: Hi there, > I installed nginx on an EC2 instance. > Another weird thing is GET > requests are starting with \*“http://”. \*I never saw it before. Is there any > way I can filter requests or possibly throw 503? These might be innocent requests from browsers configured to use your IP address as a proxy server. (Maybe there was a proxy server on a previous instance that used your current address?) I suggest making your current server{} blocks list all of the server\_name:s that you want to handle, and then let the default server{} block handle these other requests, with “return 503” or any other configuration you like. See [Module ngx\_http\_core\_module](http://nginx.org/r/listen) and [Module ngx\_http\_core\_module](http://nginx.org/r/server_name) for how to configure server names and the default server for a given address:port. f – Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![Praveen\_Yarlagadda](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b4bc9f/32.png) [@Praveen\_Yarlagadda](https://www.ruby-forum.com/u/Praveen_Yarlagadda)\ **Post date:** [March 16, 2013, 11:06am UTC](https://www.ruby-forum.com/t/some-sort-of-attack/227474/3 "2013-03-16T11:06:34Z")
On 16 March 2013 09:34, Praveen Yarlagadda [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > access\_log content, you would notice that the IP addresses are different. I > don’t see more than 3 requests in a sec. Another weird thing is GET requests > are starting with “http://”. I never saw it before. Is there any way I can > filter requests or possibly throw 503? How about location http:// { access\_log off; return 444; } ## Jonathan Jonathan M. // Oxford, London, UK > **[Jonathan Matthews :: Words Typed, Great Rates For Cash](https://www.jpluscplusm.com)** ---
**Author:** ![Praveen\_Yarlagadda](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/b4bc9f/32.png) [@Praveen\_Yarlagadda](https://www.ruby-forum.com/u/Praveen_Yarlagadda)\ **Post date:** [March 16, 2013, 8:38pm UTC](https://www.ruby-forum.com/t/some-sort-of-attack/227474/4 "2013-03-16T20:38:32Z")
Thanks a lot, Jonathan and Francis! It works great. I am able to significantly reduce the load. Here is my final configuration: - limit\_req\_zone $binary\_remote\_addr zone=ratezone:10m rate=3r/s;\* - server {\* - ``` listen 80;* ``` - ``` server_name www.example.com;* ``` - - - ``` location / {* ``` - ``` limit_req zone=ratezone burst=5 nodelay;* ``` - ``` proxy_pass http://appservers;* ``` - ``` }* ``` - }\* - - - server {\* - ``` listen 80;* ``` - ``` server_name ~.*;* ``` - ``` location / {* ``` - ``` access_log off;* ``` - ``` return 503;* ``` - ``` }* ``` - }\* -Praveen