I have a lot of php files being inserted to my server with spam mail purpose.

When i check the apache access log i notice the following line: - - [07/Mar/2017:12:28:50 -0700] "POST http://check.proxyradar.com/azenv.php?auth=148891493017&a=PSCMN&i=757631275&p=80 HTTP/1.1" 404 10269 "https://proxyradar.com/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)"

What does the line above mean exactly? when i interpret it correctly, someone send a POST request to the server, however my server responded with a 404 request. Could this be the bad request that creates the malware php files on my server?

I suspect a misconfigured server being the problem. When i block all ports except for ftp, ssh, 80, 443, etc. the attacks do not happen.

However the some services do need different ports, especially for passive FTP mode there are additional ports required.

I would like to find out how exactly the hackers get into the server.

thanks for any advice/pointer into the right direction!

  • There are no hackers getting into the server. Anyone on the internet can send a request to your apache webserver, as is the case here. That doesn't mean the webserver automatically does ahything dangerous in response. Your apache dutifully logs the request, even though it can't fulfill it (404). – Pascal Mar 8 '17 at 10:04
  • 1
    If you have PHP files getting put on your server, then this is not the corresponding log. It's impossible for us to say how they're getting there without more information, but with no further information I'd guess you have a vulnerability in a web application on the server, or you have weak / compromised FTP credentials. – DKNUCKLES Mar 8 '17 at 13:22
  • I think you run some kind of deprecated/outdated software on the Webserver. Like old Joomla or Wordpress installation. This is the culprit where the PHP files came. Check this. But better: Nuke it from the Orbit – Serverfrog Apr 7 '17 at 10:24
  • Everything is up to date – Tom Apr 8 '17 at 11:03

This is a service testing if your server is misconfigured and you are an open proxy. Nothing to worry about.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.