A site of ours has been targeted by some kind of strange attack and I am trying to work out exactly how it has happening. Basically, the strangest thing is that the logs seem to correspond to entirely different websites and thus is producing 404 errors all the time. Any ideas what kind of attack this is, how it is happening and why it is not showing the true site URL?
216.244.83.56 - - [05/Apr/2014:22:43:44 +0100] "GET http://anx.batanga.net/ttj?id=2385001&size=728x90 HTTP/1.0" 404 9 "http://www.daysalary.com/?p=1622" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/4.0.206.1 Safari/532.0"
172.246.42.217 - - [05/Apr/2014:22:43:44 +0100] "GET http://ads.yahoo.com/st?ad_type=ad&ad_size=728x90§ion=5200303&pub_url=${PUB_URL} HTTP/1.0" 404 9 "http://www.healthbecare.com/?p=408" "Mozilla/4.0 (MSIE 6.0; Windows NT 5.0)"
216.176.190.44 - - [05/Apr/2014:22:43:44 +0100] "GET http://anx.batanga.net/ttj?id=2483524&size=728x90 HTTP/1.0" 404 9 "http://www.especialfinance.com/?p=1383" "Mozilla/4.0 (compatible; MSIE 6.0; America Online Browser 1.1; rev1.5; Windows NT 5.1; SV1; FunWebProducts; .NET CLR 1.1.4322)"
67.198.154.66 - - [05/Apr/2014:22:43:44 +0100] "GET http://ad.afy11.net/srad.js?azId=1000011319807 HTTP/1.1" 404 9 "http://rumorfix.com/" "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.9.1.2) Gecko/20121231 Firefox/3.5.2 WinNT-PAI 21.07.2009"
216.244.76.188 - - [05/Apr/2014:22:43:44 +0100] "GET http://ads.yahoo.com/st?ad_type=pop&ad_size=0x0§ion=5376206&banned_pop_types=29&pop_times=1&pop_frequency=0&pub_url=${PUB_URL} HTTP/1.0" 404 9 "http://www.supermoviepass.com/index.php?option=com_content&view=article&id=1106:2013-12-18-20-38-05&catid=46:kids-movies&Itemid=160" "Opera/9.80 (Windows NT 6.0; U; en) Presto/2.7.39 Version/11.00"
208.115.109.39 - - [05/Apr/2014:22:43:45 +0100] "GET http://anx.batanga.net/ttj?id=2481220&size=300x250 HTTP/1.0" 404 9 "http://www.pusheducation.com/tag/california-community-college-listing/" "Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.9 (KHTML, like Gecko) Chrome/5.0.307.1 Safari/532.9"
As you can see in the logs this appears to be some kind of distributed denial of service. The attack is fast but not so fast that it will bring down Apache on it's own but the constant processing of application logic did put our server under a lot of strain.