Member Avatar for TySkby

Hi all,

This is my first time posting in this forum (disclaimer: please let me know if this is not the right place to post this). I'm turning to the Linux server discussion gurus for some sagely advice :)

I have a VPS web server running CentOS with Apache and all the other good web server jazz. The main website hosted on the server is (IP: ) Lately I've noticed (by stumbling across in a Google search when testing my SEO) that another domain ( or really ) is apparently forwarding all requests to my IP address. The reason I'm pretty certain they're forwarding and haven't stolen/cloned my site is because if I access that site from home, my home IP address shows up in my access logs.

I'm fairly certain this is a fledgling attack. Every once in a while my access logs will show something like this (just a sample):

111.164.160.222 - - [23/Mar/2011:06:06:33 -0500] "GET /currentIssue/cover.jpg HTTP/1.1" 200 17424 "" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; QQDownload 672; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"

111.164.160.222 - - [23/Mar/2011:06:06:42 -0500] "GET /images/logo.png HTTP/1.1" 200 5556 "" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; QQDownload 672; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"

where that domain seems to be referring style sheets, javascript files, images, etc.

So the real question is: Is there a way that I can block this site from forwarding itself to my site's IP address and essentially cloning my site?

I can think of a few reasons why I don't want this happening:
-The site (after doing some WHOIS searches) is clearly meant for malicious purposes
-The owner is listed as being in China (although not necessarily a red flag, I've had my fair share of problems with Chinese spiders and the like in the past)
-In some cases, they're stealing search engine hits
-Since it began, I've been getting some very strange query strings appearing in my access logs (eg. "?kw=%E4%B8%80%E5%93%81%E6%A5%BC%E8%AE%BA%E5%9D%9B%E6%9C%80%E6%96%B0%E5%9C%B0%E5%9D%80")
-I don't know who this is and what they're doing.

It's that last part that makes me the most suspicious- I can't figure any reason for this to be happening unless there's some kind of spoofing, injection attacks, or XSS attacks being in the works.

So please, DaniWeb folks, enlighten me- does this seem like a real threat I should be concerned about? If so, how do I go about stopping it?

Thanks much,
Ty

  • 3 Contributors
  • 5 Replies
  • 356 Views
  • 3 Weeks Discussion Span
  • Latest Post Latest Post by manojsamtani

Dani AI

Generated

This looks like hotlinking / referrer spam rather than a server compromise. The log lines show the external domain in the Referer and the client IPs are the visitors of that site — their browsers are fetching images and assets from the VPS, so those visitor IPs appear in your logs. If the third party were proxying requests while preserving their own Host header the server would see that Host; adding Host to the access logs will quickly confirm which case it is.

An application-level host check, as reports, is a simple and effective quick fix. For a more robust and permanent solution handle this at the webserver/network level so it can’t be bypassed by client-side tricks. Make the first (default) VirtualHost deliberately fail or redirect unknown Host headers to the canonical hostname, and use dedicated hotlink protection and rate‑limiters to block abusive patterns.

Example (replace placeholders with the canonical name and paths):

<VirtualHost *:80>
    ServerName default
    DocumentRoot /var/www/empty
    Redirect 301 / http://your-canonical-host.example/
</VirtualHost>

Additional practical measures: log the Host header to confirm the attack vector:

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%{Host}i\"" combined_host
CustomLog /var/log/httpd/access_log combined_host

Then consider layered defenses: referer-based hotlink blocking (careful—referers can be blank or spoofed), a WAF like mod_security, rate-limiting modules (mod_evasive — as suggested) or fail2ban to ban repeat offenders, and a CDN/reverse proxy (Cloudflare or similar) to mask origin and reduce bandwidth abuse. Keep CentOS/Apache patched and SELinux enabled where practical, as recommended. Finally, examine log patterns (User-Agent, request frequency, geographic ranges) before applying broad blocks so legitimate traffic isn’t disrupted.

Recommended Answers

All 5 Replies

Member Avatar for TySkby

Also, just for clarification, I have done a fair amount of Googling for a related problem before I posted here. However, IMO they were fairly feeble searches, the main problem being that I'm not really sure what terms to search for (I don't know if this kind of thing has a name, rather, I don't know what to call it).

So I'd like to add that any information anyone can provide about the nature of what I've been seeing, whether it's a common type of attack on security, and/or what it's called, would also be appreciated.

Member Avatar for rubberman

It sounds like some probing going on. Make sure your web server and other stuff is up-to-date security-wise. CentOS is pretty secure itself. Have you implemented SELinux extensions? That will help keep out baddies. One final thing is that you might post this to the security forum of www.linuxforums.org where there are more lurkers for Linux-specific stuff like this.

Member Avatar for TySkby

Thanks! I'll re-post on the Linux Forums. I'm going to leave this thread open for a day or two until I can post the solution offered over there.

Member Avatar for TySkby

Okay, ready to close the thread as the issue has been resolved.

To anyone interested, I used PHP ($_SERVER) to check the host and display a page informing the user that they are at the wrong site (in the case that the correct host is not in the URL).

I also have a javascript function in place as a backup to do the same thing in the event that somebody figures out a way to spoof the HTTP host.

Finally, here's a link to the Linux Forum thread that I made:
http://www.linuxforums.org/forum/servers/176731-solved-possible-attack-how-stop.html

Member Avatar for manojsamtani

might be someone is trying to attack DOS.....so try mod_evasive for the same :)


-----
Manoj

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.