My server's IP address is 192.99.168.198

Check this out...

My IP was blacklisted for spam activity on 22 websites.

This website has my IP listed as a valid proxy that was online on December 7th 2014. There's a graph of when it was online that correlates to my bandwidth usage.

Could it be possible to make a proxy using script injection? Or maybe something else was exploited.

Edit- Upon further review this may possibly be a result of my nginx configuration.

I think maybe my NodeBB 0.5.4 installation was being used as a proxy to redirect to other websites and these request are attempts to hit the proxy. I deleted the full log. It was 8.9GB before it hit its 9GB limit and I deleted it to free up space. This is a log after I fixed the problem.

What do you guys think? Maybe I'm just imagining things? I don't know what else would use over 20MB/s of traffic both ways without storing files on my server other than a proxy.

I parsed my nginx access.log with
sudo awk '($9 ~ /404/)' access.log | awk '{print $7}' | sort | uniq -c | sort -r

Ad the results are...

9 http://www.superfish.com/404
8 http://proxylist.hidemyass.com/404
8 http://cdncache1-a.akamaihd.net/404
8 http://65.182.176.90:49808/404
7 http://xa.xingcloud.com/404
76 /404
6 http://a.tfxiq.com/404
60 http://www.intershopsaver.co.uk/404
5 http://oyg.riderfordow.com/404
51 http://fonts.googleapis.com/404
4 http://icm.r.worldssl.net/404
4 http://hackshield.nexoneu.com/404
4 http://clkmon.com/404
4 http://api.crtinv.com/404
48 http://koubei.baidu.com/404
3 http://thw.runninglowend.com/404
3 http://static.icmwebserv.com/404
3 http://istatic.datafastguru.info/404
3 http://intext.nav-links.com/404
3 http://ctx.linkbolic.com/404
3 http://cjs.linkbolic.com/404
3 http://cdnjs.cloudflare.com/404
3 http://bd.xingcloud.com/404
3 http://app-static.mypartnerapp.com/404
3 http://apl.gamesrepairfix.com/404
2 http://www.delta-homes.com/404
2 http://snk.quicknessrun.com/404
2 http://s.crdrjs.info/404
2 http://pagead2.googlesyndication.com/404
2 http://c.ztstatic.com/404
2 http://combatarms.nexoneu.com/404
2 http://c.crdrjs.info/404
2 http://a.visadd.com/404
2 http://a.thanksearch.com/404
2 http://asrv-a.akamaihd.net/404
2 http://ads.tfxiq.com/404
2 http://31.31.72.144/404
2 http://109.234.76.31:7999/404
1 /topic/vendor
1 /topic/forum
1 /topic/admin
1 /topic/2/sss
1 /topic/1/welcome-to-your-nodebb?page=2
1 /topic/1/welcome-to-your-nodebb/google.com
1 /topic/1/welcome-to-your-nodebb/1
1 /topic/1/welcome-to-your-nodebb
1 /topic/1/google.com
1 http://www.youradexchange.com/404
1 http://www.samair.ru/404
1 http://www.google-analytics.com/404
1 http://www.bigspeedpro.com/404
1 http://wcrawler-proxy.baza-winner.ru/404
1 http://serviceama-a.akamaihd.net/404
1 http://q.crdrjs.info/404
1 http://offers.bycontext.com/404
1 http://nntime.com/404
1 http://mc.yandex.ru/404
1 http://hdsrc-a.akamaihd.net/404
1 http://hdapp1008-a.akamaihd.net/404
1 http://free-proxy.cz/404
1 http://extclickmedia-maynemyltf.netdna-ssl.com/404
1 http://crs.thetrafficstat.net/404
1 http://caimage.nexoneu.com/404
1 http://b.thanksearch.com/404
1 http://api.twitch.tv/kraken/users/ShayBooshAware/follows/channels/underm inegamingch
1 http://aff3.gittigidiyor.com/404
1 http://adplus.goo.mx/404
1 http://173.255.140.27/404
1 /category/forum
1 /category/4/unreal-4-random?page=1
1 /api/user/forum
1 /api/topic/2/sss
1 /api/topic/1/welcome-to-your-nodebb/11
1 /api/topic/1/welcome-to-your-nodebb
11 http://torpedo.oiloja.com.br/404

Nope, nothing appeared to change in the forums. No users created or anything. There were attempts to register users with wrong captchas if I remember right.

A testament to NodeBB though, it held up and served pages for like 12 hours with really heavy usage on a 1GB 1Core VPS

So you think it may have just been a denial of service attack that happened to stop when I took the server offline? It was only hitting my subdomain, not the IP address. Hmmm

Traffic was coming to and from the nginx proxy. A peak of 28MB/s out and 25MB/s in. It was almost like the site was relaying traffic. Netstat was saying my server was making requests to connect to other servers. (As well as receiving connection requests, which of course would be expected.

I find it curious. I wish I had let it run for a while and figured it out. When I updated NodeBB it stopped. The downtime you see on the graph is when I shut down the server and mounted the file system in another OS to read the logs.

Makes me want to set up a honepot install and wait for it to be found. (And limit the resource usage of course)

Hello guys,

I didn't upgrade to 0.5.7 immediately and 48hrs ago I suffered sustained 24MB/s web traffic. I shut down nginx, deleted a massive log (8.9GB) and then proceeded to upgrade NodeBB. When I turned nginx back on the problem was resolved. (I was at 0.5.4 due to my site being used as an experiment.)

How likely do you guys think the password hashes were compromised? Was it likely an XSS exploit? I watched the traffic for a while. Connection requests were coming from many different domains not running NodeBB, so it appears the NodeBB exploit was tied into a larger group of exploits, possibly a botnet?

What are your guys thoughts? Did anyone else experience this? I'm mostly posting out of curiosity.

Thanks for your hard work on this awesome project! Soon phpBB will be history