-----Original Message-----
From: drupal-support-bounces@xxxxxxxxxx
Hi
> Last week, I noticed bandwidth consumption had jumped dramatically on my
> Drupal site, from maybe 500 megabytes a day to 2.2 gigabytes a day.
> Here's one example:
> www.universalhub.com 221.232.79.8 - - [01/Sep/2004:00:31:21 -0400] "GET
> http://www.xmlrevenue.com/s.php?keywords=DSL&username=infome
> nl HTTP/1.0" 200 39857 "http://www.gbahome.com/ads/xmlrevenue.htm";
> "Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.1)"
Just to make sure we are using teh same defenitions. Your host (universalhub)
has been accessed by 221.232.79.8 and this client did a get of the file
s.php[...]infomenl from the host xmlrevenue.com with a referrer from
gbahome.com and this request was *successfull* (200)?
This results in the following:
* you are being abused either as a refer bomb or for -more likely- a adware
abuse
* your webserver is serving this page and generates this page with a status 200
(checked with livehttpheaders, old drupal error of servering a 404 with a 200)
* your webserver is listening to *any* website address (checked with adding
your ip to my /etc/hosts with ww.somesite.com, your webserver is serving the
page)
I would advise to do the following
* make sure that there are known exploitable php scripts on your server and
there is no weird activity in the system logfiles (last/syslog/security etc)
* block any referrer from gbahome.com in your apache config
* make sure your webserver only serves pages for the FQDName(s) and its IP
addres(es), not for other sites
* file an abuse (from a spamable email addres :-) to xmlrevenue, including log
files and timezone the were gathered in, that way the lame kiddie wont get paid!
* upgrade to a later drupal version were the 200 status is solved for a 404 (is
this in 4.5?)
Hope this helps
--
groets,
bert boerland
--- pinkroccade infrastructure services ---
Unless your universe is very different from mine,
you can't save time.
voice://020-5704939/ http://www.pinkroccade.nl/
--
[ Drupal support list | http://list.drupal.org/ ]
|
