Unusual traffic with POST status

  • I’ve been getting this type of traffic on my site. Here’s a sample from my access log. I don’t have any idea to stop it. Please help.

    95.56.74.200 - - [30/Aug/2013:12:43:54 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
117.241.48.101 - - [30/Aug/2013:12:43:55 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
171.97.171.127 - - [30/Aug/2013:12:43:55 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
189.137.176.109 - - [30/Aug/2013:12:43:56 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
183.82.1.13 - - [30/Aug/2013:12:43:56 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
83.160.91.252 - - [30/Aug/2013:12:43:56 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
203.74.0.211 - - [30/Aug/2013:12:43:57 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
114.143.167.11 - - [30/Aug/2013:12:43:57 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
122.161.102.170 - - [30/Aug/2013:12:43:58 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
114.143.32.198 - - [30/Aug/2013:12:43:58 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
187.150.57.67 - - [30/Aug/2013:12:43:58 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
119.154.240.182 - - [30/Aug/2013:12:43:59 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
113.28.224.10 - - [30/Aug/2013:12:43:59 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
110.168.197.229 - - [30/Aug/2013:12:43:59 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
78.22.27.239 - - [30/Aug/2013:12:43:59 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
94.156.247.94 - - [30/Aug/2013:12:44:00 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
85.65.141.248 - - [30/Aug/2013:12:44:01 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
112.119.237.197 - - [30/Aug/2013:12:44:01 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
119.93.23.96 - - [30/Aug/2013:12:44:01 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
106.51.151.134 - - [30/Aug/2013:12:44:01 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
114.79.12.178 - - [30/Aug/2013:12:44:01 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
77.36.236.130 - - [30/Aug/2013:12:44:01 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
122.166.1.27 - - [30/Aug/2013:12:44:02 +0800] "POST / HTTP/1.0" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
93.86.161.12 - - [30/Aug/2013:12:44:02 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
103.12.132.66 - - [30/Aug/2013:12:44:02 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
114.143.32.198 - - [30/Aug/2013:12:44:02 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
86.134.74.100 - - [30/Aug/2013:12:44:03 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
2.180.11.163 - - [30/Aug/2013:12:44:04 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
24.182.149.150 - - [30/Aug/2013:12:44:04 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
151.245.13.167 - - [30/Aug/2013:12:44:04 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
83.39.194.47 - - [30/Aug/2013:12:44:05 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
181.166.98.251 - - [30/Aug/2013:12:44:05 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
69.125.251.89 - - [30/Aug/2013:12:44:06 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
46.40.121.209 - - [30/Aug/2013:12:44:06 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
61.7.190.76 - - [30/Aug/2013:12:44:06 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
83.160.91.252 - - [30/Aug/2013:12:44:07 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
108.81.171.199 - - [30/Aug/2013:12:44:07 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
61.15.174.108 - - [30/Aug/2013:12:44:07 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
115.240.215.74 - - [30/Aug/2013:12:44:07 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
101.109.2.129 - - [30/Aug/2013:12:44:08 +0800] "POST / HTTP/1.1" 301 - "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)"
Viewing 4 replies - 16 through 19 (of 19 total)
  • Thread Starter wtreyes

    (@wtreyes)

    Hi aommundsen, I’m sorry to say that we didn’t completely solve the issue. What we did was change their domain name (since their account was the one targeted) as a band-aid solution. We also suggested cloudflare.

    For us, the firewall rule mitigated the issue. A more permanent fix was accomplished by changing the site’s ip address and then blackholing the original ip.

    I don’t use WordPress but someone pointed me to this thread so I thought I would share what I have found out about this problem.

    It seems to be caused by a recent variant of the Pushdo virus. It does not mean that your systems are infected, but that they are being contacted by infected machines.

    The later variants of the Pushdo virus (and probably a few others now) are masking their true command and control systems by also contacting 300 other non infected sites (see here) The description given in the article does not fit exactly, as they describe a GET request whereas I am receiving POSTs but I have seen other reports of variants using POST.

    The virus uses an algorithm to come up with 300 domain names, and it apears that yours (as well as mine) is one of the unfortunate ones. I am also receiving SMTP traffic from the same IPs, which fits in with the Pushdo ‘modus operandi’ as it also tries to send Spam at the same time. So if you run your own email server you may want to check those logs too.

    I don’t actually think there are that many infected systems contacting my domain(despite the fact I have logged over 100K different IPs) but rather the IPs are spoofed (I have yet to find a definitive answer on this). Inspecting the incoming packet TTLs with tcpdump *seems* to indicate 4 different sources but this is a VERY unreliable method. Also the steady stream of traffic would point to a low number of sources as there are no peaks and troughs as there would be if all these IPs were real?? If all the thousands of IPs I have logged were real I am sure they would have swamped the server a long time ago!

    I am not able to offer a solution, sorry. I started banning the IPs with Fail2Ban but after 100K IPs banned I gave up on that idea as the overhead was getting too high! I am now using .htaccess to redirect the http POST traffic from that user-agent to a non existent domain. Unfortunately using iptables to block it causes my Apache to generate lots of child processes that refuse to die, causing instability so I cannot use that method. The SMTP requests simply return a bad request message which uses almost no resources so I have left that to it.

    Sorry again for not having a solution but hopefully this additional info may help someone.

    Thread Starter wtreyes

    (@wtreyes)

    Thanks for the info @scott_g.

    Here’s more info about the Pushdo virus and how you can mitigate it.
    https://www.distilnetworks.com/is-pushdo-screwing-you-details-of-the-botnet/

Viewing 4 replies - 16 through 19 (of 19 total)
  • The topic ‘Unusual traffic with POST status’ is closed to new replies.