Strange flood of requests to my web server

Question

About an hour ago, strange requests began showing up in my access logs. They are coming in at a rate of ca. 400 req/s and appear to come from IPs all over the place. It started out at a lover rate and has been increasing, which worries me. The requests look like this:

63.141.242.51 - - [17/Aug/2014:19:10:50 +0000]  "GET http://anx.batanga.net/tt?id=3011996&cb=[CACHEBUSTER]&referrer=[REFERRER_URL]&pubclick=[INSERT_CLICK_TAG] HTTP/1.0" http 200 0.000 612 "http://www.youdaoqii.com/news/014082324453123443.html" "Mozilla/5.0 (X11; U; Linux i686; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.211.0 Safari/532.0"
107.151.241.5 - - [17/Aug/2014:19:10:50 +0000]  "GET http://ib.adnxs.com/tt?id=3351132&referrer=yesshealth.com HTTP/1.0" http 200 0.000 612 "http://wwww.yesshealth.com" "Mozilla/4.0 (compatible; MSIE 8.0; AOL 9.5; AOLBuild 4337.43; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
67.198.137.236 - - [17/Aug/2014:19:10:50 +0000]  "GET http://anx.batanga.net/ttj?id=3289594&cb=[CACHEBUSTER]&referrer=[REFERRER_URL]&pubclick=[INSERT_CLICK_TAG] HTTP/1.0" http 200 0.000 612 "http://www.formerfinance.com/?p=1363" "Mozilla/4.0 (compatible; MSIE 8.0; AOL 9.6; AOLBuild 4340.27; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"
198.204.227.19 - - [17/Aug/2014:19:10:50 +0000]  "GET http://anx.batanga.net/tt?id=3087276&cb=[CACHEBUSTER]&referrer=[REFERRER_URL]&pubclick=[INSERT_CLICK_TAG] HTTP/1.0" http 200 0.000 612 "htp://www.canyouqq.com/news/2014/34457v0947608250480.html" "Mozilla/4.0 (compatible; MSIE 8.0; AOL 9.6; AOLBuild 4340.17; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"
198.204.231.173 - - [17/Aug/2014:19:10:50 +0000]  "GET http://anx.batanga.net/tt?id=3087276&cb=[CACHEBUSTER]&referrer=[REFERRER_URL]&pubclick=[INSERT_CLICK_TAG] HTTP/1.0" http 200 0.000 612 "htp://www.canyouqq.com/news/2014/344570947608250480.html" "Mozilla/4.0 (compatible; MSIE 8.0; AOL 9.6; AOLBuild 4340.17; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)"
67.229.227.59 - - [17/Aug/2014:19:10:50 +0000]  "GET http://anx.batanga.net/tt?id=3253370&cb=[CACHEBUSTER]&referrer=[REFERRER_URL]&pubclick=[INSERT_CLICK_TAG] HTTP/1.0" http 200 0.000 612 "http://www.selfisheducation.com/walmart-scholarships-provides-students-with-millions-for-college/feed/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; Acoo Browser; GTB6; 001|Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) ; InfoPath.1; .NET CLR 3.5.30729; .NET CLR 3.0.30618)"
107.151.233.52 - - [17/Aug/2014:19:10:50 +0000]  "GET http://ib.adnxs.com/tt?id=3351132&referrer=yesshealth.com HTTP/1.0" http 200 0.000 612 "http://wwww.yesshealth.com" "Mozilla/4.0 (compatible; MSIE 6.0; AOL 8.0; Windows NT 5.1; SV1)"

I found another question where someone seems to be getting the same kind of traffic: Strange Apache access logs The conclusion seems to be that it is a scan for open proxies. But if this is a scan, shouldn't it come from a single (or a few) IPs? This appears to be something else, in my limited knowledge.

Can anyone confirm that this is just a scan or perhaps tell me what is going on?

I'm running nginx and while the traffic is quite a lot, it's not currently causing any problems.

Answer 1

I found this article, which seems to explain what's going on: https://wiki.apache.org/httpd/ProxyAbuse

I have modified the default host config to return http 444 now. Hopefully the culprits will realise that this is not an open proxy and just go away at some point.

E.g.:

server {
        listen 80 default_server;
        listen [::]:80 default_server ipv6only=on;

        root /usr/share/nginx/html;
        index index.html index.htm;

        # Make site accessible from http://localhost/
        server_name localhost;

        location / {
                return 444;
        }
}

Seems to work. 10 minutes after I inserted this, the traffic dropped considerably. I assume that the fact that nginx was responding with http 200 to the proxy requests, meant that the culprit thought it worked as a proxy (Even though it was just serving the default server page). Responding with an error must have tipped them off.