Strange Apache access logs

Question

A site of ours has been targeted by some kind of strange attack and I am trying to work out exactly how it has happening. Basically, the strangest thing is that the logs seem to correspond to entirely different websites and thus is producing 404 errors all the time. Any ideas what kind of attack this is, how it is happening and why it is not showing the true site URL?

216.244.83.56 - - [05/Apr/2014:22:43:44 +0100] "GET http://anx.batanga.net/ttj?id=2385001&size=728x90 HTTP/1.0" 404 9 "http://www.daysalary.com/?p=1622" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.206.1 Safari/532.0"
172.246.42.217 - - [05/Apr/2014:22:43:44 +0100] "GET http://ads.yahoo.com/st?ad_type=ad&ad_size=728x90&section=5200303&pub_url=${PUB_URL} HTTP/1.0" 404 9 "http://www.healthbecare.com/?p=408" "Mozilla/4.0 (MSIE 6.0; Windows NT 5.0)"
216.176.190.44 - - [05/Apr/2014:22:43:44 +0100] "GET http://anx.batanga.net/ttj?id=2483524&size=728x90 HTTP/1.0" 404 9 "http://www.especialfinance.com/?p=1383" "Mozilla/4.0 (compatible; MSIE 6.0; America Online Browser 1.1; rev1.5; Windows NT 5.1; SV1; FunWebProducts; .NET CLR 1.1.4322)"
67.198.154.66 - - [05/Apr/2014:22:43:44 +0100] "GET http://ad.afy11.net/srad.js?azId=1000011319807 HTTP/1.1" 404 9 "http://rumorfix.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.1.2) Gecko/20121231 Firefox/3.5.2 WinNT-PAI 21.07.2009"
216.244.76.188 - - [05/Apr/2014:22:43:44 +0100] "GET http://ads.yahoo.com/st?ad_type=pop&ad_size=0x0&section=5376206&banned_pop_types=29&pop_times=1&pop_frequency=0&pub_url=${PUB_URL} HTTP/1.0" 404 9 "http://www.supermoviepass.com/index.php?option=com_content&view=article&id=1106:2013-12-18-20-38-05&catid=46:kids-movies&Itemid=160" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.39 Version/11.00"
208.115.109.39 - - [05/Apr/2014:22:43:45 +0100] "GET http://anx.batanga.net/ttj?id=2481220&size=300x250 HTTP/1.0" 404 9 "http://www.pusheducation.com/tag/california-community-college-listing/" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.9 (KHTML, like Gecko) Chrome/5.0.307.1 Safari/532.9"

As you can see in the logs this appears to be some kind of distributed denial of service. The attack is fast but not so fast that it will bring down Apache on it's own but the constant processing of application logic did put our server under a lot of strain.

Answer 1

It seems "they" are trying to get different ads through your server - expecting it to behave as an HTTP proxy server. (Maybe your was misconfigured before to be an open proxy.)

Instead of sending a:

GET /filename.php HTTP/1.1

They're sending a

GET http://adhost.com/dir/file HTTP/1.1

This way, "they" will be able to render many ads for their websites, coming from different IP addresses, essentially driving up their impressions, and potentially getting more money.

Ensure your server is not an open proxy, and else - don't worry, bots send all kind of requests to any public webserver.

Answer 2

This is normal fingerprint scan. Various tools sent direct/odd looking GET requests. It is usually done to detect the type of server and other information. There is no real "magic" here. It can be faked.

Answer 3

this is a usual open-proxy-scan ("GET http://..." instead of a npormal GET - Request like "GET /index.html") which is answered by a 404 - Not -Found-Error from your server, so no need for action from your site