How easy is it to spoof IP / referrer?
In my apache logs I am getting 100s of errors every hour and each referrer IP Address is Chinese. Some examples of files trying to be accessed are:
sproxy.php
s.php
search.php
search
feed
cgi-bin
Every time I block an address (usually I block the /16 network block of the isp) a different one comes up yet still from china. Also the referrer is always from a different. Here are some examples:
http://www.seeks-search.net/dollar-searching.htm
http://www.luckingsearch.com/dollar-searching.htm
http://xp-search.com/images/ok.htm
http://www.2008-email.com/sprucer.htm
As you can see there is nothing wrong with these sites they are simple htm pages Could this be a Trojan that is attacking my server or could it be a program that is spoofing the ip and referrer?
Any assistance would be greatly appreciated!
