I have a lot of php files being inserted to my server with spam mail purpose.
When i check the apache access log i notice the following line:
18.104.22.168 - - [07/Mar/2017:12:28:50 -0700] "POST http://check.proxyradar.com/azenv.php?auth=148891493017&a=PSCMN&i=757631275&p=80 HTTP/1.1" 404 10269 "https://proxyradar.com/" "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)"
What does the line above mean exactly? when i interpret it correctly, someone send a POST request to the server, however my server responded with a 404 request. Could this be the bad request that creates the malware php files on my server?
I suspect a misconfigured server being the problem. When i block all ports except for ftp, ssh, 80, 443, etc. the attacks do not happen.
However the some services do need different ports, especially for passive FTP mode there are additional ports required.
I would like to find out how exactly the hackers get into the server.
thanks for any advice/pointer into the right direction!