What is the purpose of this attack?

Question

The following is an excerpt of an apache access log output during the last 24 hours. http://pastebin.com/imtJfvLE

Notes:

1. The requests come from more than 5733 unique IP addresses
2. ~2 requests per second, totaling ~5GB log data per day
3. From metrics, it is shown that outbound traffic is about one order of magnitude larger than inbound traffic, due to these requests.

The assumption is that this is an attack of some sort, or a usage of my server for some reason. But I cannot come to a conclusion as to what its purpose is.

Currently I have written an apache RewriteRule to redirect all of this traffic to a nonexistent domain. At the least, if this is some sort of participation in an odd DDOS attack, it will receive a 301 in return, thus significantly reducing packet size. Ideally I would implement some type of layer 7 firewall that would simply drop the packets, but seeing as this is a Azure VM, that is difficult.

Would you be able to help me determine the attack's purpose, and if possible, how to mitigate it?

Answer 1

Looking at the excerpt, the following URL appears to be common across all the requests:

zukexupyqiv.wordpress.com%2F2013%2F05%2F06%2Fcreate-a-note-of-the-puppy-testimonials-purchasing-mal-shi-pups-for

The URL has been taken down by wordpress for unknown reasons - maybe because others also observed this kind of activity affecting their websites and complained to wordpress.

I suspect the intention of the activity is to simply spam your server, and force you as the system administrator to visit the URL above by consuming storage space on your disk and filling up the logs.

This is indicated from the following sentence in the requests: "I know this site offers quality dependent articles and extra material, is there any other site which provides these kinds of things in quality"

PS: Incidentally, the GET requests appear to be structured in a format, as if someone is submitting an online form as seen from the parameter called "postcomment". This might be because it is easy to send requests like this.

UPDATE: I would mitigate this activity by parsing requests for common terms in all the requests e.g. the URL above, key terms listed above, and simply dropping these requests. Dropping the requests should reduce the load on your server. If you have a large website with global audience, you could consider a CDN service like Akamai which optionally provides a Web Application Firewall (WAF) to offload the work of mitigating DOS and other types of attacks.