[cobalt-users] proxy abuse/porn-site banner-ad impression scripts

[Mark Chamberlain <mark@xxxxxxxxxxxxxxx>]

I¹ve noticed from my webalizer stats that my RaQ3 is somehow being used by
people to fake banner-ad impressions on porn-sites. A lot of these are
coming from Italian users, originating in the edisons.it domain. I have
proxying explicity switched off, is there some Apache exploit I¹m not aware
of? 

I¹m presuming that somehow my RaQ address has also got into one of these
banner ad scripts as there are a few hits from a variety of sites ­ I
believe that the porn sites use these to fake click-thru¹s on banner ads
which then generate small amounts of cash.

I¹ve got a (growing) list of blocked IP addresses to get round the problem,
but can anyone give me pointers to what the hole is? I¹m going to upgrade to
the latest version of Apache anyway, but it would be nice to know how
they¹re doing it.

I can¹t believe I¹m the only one either, this could be quite a big problem
on RaQs

Mark