Forum: NGINX logs show massive spam of "proxy.php" access

2974d09ac2541e892966b762aad84943?d=identicon&s=25 dfumagalli (Guest)
on 2013-07-16 16:35
(Received via mailing list)
Hello,

since I have installed nxginx on my Ubuntu LTS, I see the logs
absolutely
full of text like this:

2013/07/16 11:07:43 [error] 24590#0: *445 rewrite or internal
redirection
cycle while internally redirecting to "/index.php", client:
91.237.249.99,
server: www.[my host name].com, request: "POST
http://50.56.191.147/~cashcorp/proxies/engine.php HTTP/1.0", host:
"50.56.191.147", referrer:
"http://50.56.191.147/~cashcorp/proxies/engine.php"

2013/07/16 11:09:23 [error] 24590#0: *449 rewrite or internal
redirection
cycle
while internally redirecting to "/index.php", client: 89.69.13.95,
server:
www.[my host name].com, request: "POST
http://discountbaby63.ru/proxyc/engine.php HTTP/1.0", host:
"discountbaby63.ru", referrer:
"http://discountbaby63.ru/proxyc/engine.php"

 2013/07/16 11:10:29 [error] 24590#0: *453 rewrite or internal
redirection
cycle while internally redirecting to "/index.php", client:
142.4.98.163,
server: www.fleurworld.com, request: "POST
http://spamstats.net/proxyc/engine.php HTTP/1.0", host: "spamstats.net",
referrer: "http://spamstats.net/proxyc/engine.php"


Is this an issue due to mis-configuration? Are they hackers? Are they
succeeding at their hacking?

Posted at Nginx Forum:
http://forum.nginx.org/read.php?2,240914,240914#msg-240914
36a8284995fa0fb82e6aa2bede32adac?d=identicon&s=25 Francis Daly (Guest)
on 2013-07-16 19:50
(Received via mailing list)
On Tue, Jul 16, 2013 at 10:34:17AM -0400, dfumagalli wrote:

Hi there,

> since I have installed nxginx on my Ubuntu LTS, I see the logs absolutely
> full of text like this:
>
> 2013/07/16 11:07:43 [error] 24590#0: *445 rewrite or internal redirection
> cycle while internally redirecting to "/index.php", client: 91.237.249.99,
> server: www.[my host name].com, request: "POST
> http://50.56.191.147/~cashcorp/proxies/engine.php HTTP/1.0", host:
> "50.56.191.147", referrer:
> "http://50.56.191.147/~cashcorp/proxies/engine.php"

It looks like the client is trying to use you as a proxy server, and
you have a config problem which leads to this cycle mentioned in your
error log.

There's no obvious mention of the proxy.php in your Subject: line,
though.

  f
--
Francis Daly        francis@daoine.org
Please log in before posting. Registration is free and takes only a minute.
Existing account

NEW: Do you have a Google/GoogleMail, Yahoo or Facebook account? No registration required!
Log in with Google account | Log in with Yahoo account | Log in with Facebook account
No account? Register here.