Re: [arch-general] My Apache Sever Compromised?

2014-04-10 Thread Bardur Arantsson
On 2014-04-09 19:32, Jameson wrote: On Tue, Apr 1, 2014 at 9:30 AM, Nowaker enwuk...@gmail.com wrote: 199.83.93.35 - - [29/Mar/2014:22:04:54 -0400] GET http://ro2.biz/pixel.png HTTP/1.0 200 151 But the most interesting part is that your apache is replying with 200, that is OK! Nice

Re: [arch-general] My Apache Sever Compromised?

2014-04-09 Thread Jameson
On Tue, Apr 1, 2014 at 9:30 AM, Nowaker enwuk...@gmail.com wrote: 199.83.93.35 - - [29/Mar/2014:22:04:54 -0400] GET http://ro2.biz/pixel.png HTTP/1.0 200 151 But the most interesting part is that your apache is replying with 200, that is OK! Nice catch! It's certainly a proxy. Thanks

Re: [arch-general] My Apache Sever Compromised?

2014-04-09 Thread ProgAndy
Am 09.04.2014 19:32, schrieb Jameson: On Tue, Apr 1, 2014 at 9:30 AM, Nowaker enwuk...@gmail.com wrote: 199.83.93.35 - - [29/Mar/2014:22:04:54 -0400] GET http://ro2.biz/pixel.png HTTP/1.0 200 151 But the most interesting part is that your apache is replying with 200, that is OK! Nice

Re: [arch-general] My Apache Sever Compromised?

2014-04-09 Thread ger...@gmail.com
On Wed, Apr 9, 2014 at 7:38 PM, ProgAndy ad...@progandy.de wrote: Am 09.04.2014 19:32, schrieb Jameson: On Tue, Apr 1, 2014 at 9:30 AM, Nowaker enwuk...@gmail.com wrote: 199.83.93.35 - - [29/Mar/2014:22:04:54 -0400] GET http://ro2.biz/pixel.png HTTP/1.0 200 151 But the most interesting

Re: [arch-general] My Apache Sever Compromised?

2014-04-01 Thread Rodrigo Rivas
On Sun, Mar 30, 2014 at 4:37 AM, Jameson imntr...@gmail.com wrote: I'm seeing some very strange behavior from my Apache web server, and I'm afraid it may have been compromised. Every time I start it, my router is saturated with the maximum number of connections it can handle, and my access_log

Re: [arch-general] My Apache Sever Compromised?

2014-04-01 Thread Nowaker
199.83.93.35 - - [29/Mar/2014:22:04:54 -0400] GET http://ro2.biz/pixel.png HTTP/1.0 200 151 But the most interesting part is that your apache is replying with 200, that is OK! Nice catch! It's certainly a proxy. See? The request asks for all the URL, http:// and host name included,

Re: [arch-general] My Apache Sever Compromised?

2014-03-31 Thread Jameson
On Mon, Mar 31, 2014 at 6:36 AM, Simon Brand simon.br...@postadigitale.de wrote: You can also use Thanks for all the suggestions, guys. I'll probably do some further checking just to make sure nothing else is going on, but once I created a rewrite rule to drop those connections instead of

Re: [arch-general] My Apache Sever Compromised?

2014-03-30 Thread Theo Jones
or rkhunter (these return a LOT of false positives). 7. Has anything else been acting up with the server? A lot of cracks break other things. ---Theo Date: Sat, 29 Mar 2014 22:45:35 -0400 From: imntr...@gmail.com To: arch-general@archlinux.org Subject: Re: [arch-general] My Apache Sever

[arch-general] My Apache Sever Compromised?

2014-03-29 Thread Jameson
I'm seeing some very strange behavior from my Apache web server, and I'm afraid it may have been compromised. Every time I start it, my router is saturated with the maximum number of connections it can handle, and my access_log starts filling with lines like: 208.115.242.252 - -

Re: [arch-general] My Apache Sever Compromised?

2014-03-29 Thread Nowaker
I'm seeing some very strange behavior from my Apache web server, and I'm afraid it may have been compromised. Every time I start it, my router is saturated with the maximum number of connections it can handle, and my access_log starts filling with lines like: Start whatever HTTP server in place

Re: [arch-general] My Apache Sever Compromised?

2014-03-29 Thread Jameson
On Sat, Mar 29, 2014 at 10:41 PM, Nowaker enwuk...@gmail.com wrote: I'm seeing some very strange behavior from my Apache web server, and I'm afraid it may have been compromised. Every time I start it, my router is saturated with the maximum number of connections it can handle, and my