Hi,
In my webserver log i have found the following entrys
66.36.231.31 - - [23/Jul/2006:04:10:31 +0200] "CONNECT 64.12.200.89:443 HTTP/1.0" 200 - "-" "Mozilla/7.00 [en] (WinNT; U ;Nav)"
66.36.231.31 - - [23/Jul/2006:04:10:33 +0200] "CONNECT 205.188.179.233:443 HTTP/1.0" 200 - "-" "Mozilla/7.00 [en] (WinNT; U ;Nav)"
66.36.231.31 - - [23/Jul/2006:04:10:33 +0200] "CONNECT 64.12.200.89:443 HTTP/1.0" 200 - "-" "Mozilla/7.00 [en] (WinNT; U ;Nav)"
66.36.231.31 - - [23/Jul/2006:04:10:35 +0200] "CONNECT 205.188.179.233:443 HTTP/1.0" 200 - "-" "Mozilla/7.00 [en] (WinNT; U ;Nav)"
66.36.231.31 - - [23/Jul/2006:04:10:35 +0200] "CONNECT 205.188.153.121:443 HTTP/1.0" 200 - "-" "Mozilla/7.00 [en] (WinNT; U ;Nav)"
217.20.215.114 - - [23/Jul/2006:04:10:36 +0200] "CONNECT 64.12.200.89:443 HTTP/1.0" 200 - "-" "-"
66.36.231.31 - - [23/Jul/2006:04:10:38 +0200] "CONNECT 64.12.161.185:443 HTTP/1.0" 200 - "-" "Mozilla/7.00 [en] (WinNT; U ;Nav)"
66.36.231.31 - - [23/Jul/2006:04:10:38 +0200] "CONNECT 64.12.200.89:443 HTTP/1.0" 200 - "-" "Mozilla/7.00 [en] (WinNT; U ;Nav)"
I managed to remove the entrys by adding the following lines in my httpd.conf (this is others trying to use my server as a proxy for ICQ, MSN and other chat system)
<Location />
<Limit CONNECT>
Order deny,allow
Deny from all
</Limit>
</Location>
Now i have the problem that some still manage to use my server as a proxy. The log entry looks like this
211.143.11.162 - - [24/Jul/2006:19:04:39 +0200] "GET http://www.800-search.com/index.php?uid=472&REQ=Lodging HTTP/1.1" 200 9912 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)"
I have removed Mod proxy from loading as well as Mod rewrite. Does anyone know how i can stop the entry like above from at least giving a response 200 reply ? For other "spam" request, i would like to generate at least a 404 reply.. Anyone how seen this before, and what have you done about it ? My website has used arround 30 GB bandwith in 2 days for this kind of spam.. Help would be highly gratefull.
Best regards,
Thomas
Last edited by ThomasNederman; 07-24-2006 at 01:11 PM..
|
