Revenge is a dish best served spitefully
Gather round for a silly and petty story of one man's fight against spam
So I was checking the logs of one of my web servers and I saw masses of spam from a series of similar domains. My backend web server, the screens ession it was running in and my DB were down but my Nginx reverse proxy was alive. This made panic and start going through incident response assuming I’d been hacked and that my server was being used as some kind of C2 given all the weird traffic I was seeing in my logs.
I proceeded to quickly scp all logs and history files to my local p.c. where I combed through them. I checked running processes, recently altered files, doubled checked all service confs. But all to no avail…
I logged in to my email that I use for this web server’s hosting and saw a message from Linode that the physical box had gone down had had to undergo an emergency repair.
This explained why only the Nginx proxy was up. Out of all my services it was the only one running under a systemd service. So it naturally came back up after the outage and the others obviously didn’t. (As this is my personal site I don’t think I’m going to configure any other auto scripts for the DB or back end web server but I might if this keeps happening.) This also explained why I couldn’t find any signs of intrusion other than the weird web error logs.
I contacted Linode just in case there was something going on here that I wasn’t aware of but no. The outage had nothing to do with this as I suspected.
After reaching out to the site owners who were pointing their domains at my site and receiving no response, my Nginx config now has the following lines added:
#Spam spam spam!
server {
listen 80;
listen [::]:80;
# Spam domain names.
server_name thoughtfulpet.com thoughtfulpet.co.uk thoughtfulpetfoodstore.com thoughtfulpets.com;
# redirect the spam to somewhere appropriate...
return 301 https://www.youtube.com/watch?v=dQw4w9WgXcQ;
}
server {
listen 443;
listen [::]:443;
# Spam domain names.
server_name thoughtfulpet.com thoughtfulpet.co.uk thoughtfulpetfoodstore.com thoughtfulpets.com;
# redirect the spam to somewhere appropriate...
return 301 https://www.youtube.com/watch?v=dQw4w9WgXcQ;
}
They’re all in the config I posted. I got the list by cat-ing my logs and grep-ing for thoughtful.