I use Centos 4.2 with all service pack installed. I verified traffic on link WEB and I see port TCP 80 with many traffic. I accessed lod /var/log/httpd/access_log and show below. ca.com/members/index.php HTTP/1.0" 401 - "http://members.sapphicerotica.com/members/index.php" "Mozilla/5.0 ( compatible; MSIE 5.01; Windows XP; NetCaptor )" 68.119.110.138 - - [30/Jan/2006:15:08:08 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=NsyncAngel9&passwd=xxxx HTTP/1.0" 200 9794 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:10 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=CoolPimP2&passwd=xxxx HTTP/1.0" 200 9786 "-" "-" 80.144.212.33 - - [30/Jan/2006:15:08:09 -0200] "GET http://www.995members.com/members/ HTTP/1.0" 401 472 "http://www.995members.com" "Mozilla/5.0 ( Windows; U; Windows NT5.1; DigiExt )" 68.119.110.138 - - [30/Jan/2006:15:08:10 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=Cool19999&passwd=xxxx HTTP/1.0" 200 9786 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:12 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=COOL699&passwd=xxxx HTTP/1.0" 200 9786 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:13 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=COOL696&passwd=xxxx HTTP/1.0" 200 9786 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:14 -0200] "GET http://211.115.101.253/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=Cool1875&passwd=xxxx HTTP/1.0" 200 9786 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:16 -0200] "GET http://216.109.126.252/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=Cool69_&passwd=xxxx HTTP/1.0" 999 4445 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:17 -0200] "GET http://216.109.126.252/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=Cool6665&passwd=xxxx HTTP/1.0" 999 4445 "-" "-" 68.119.110.138 - - [30/Jan/2006:15:08:18 -0200] "GET http://216.109.126.252/config/login?.done=http://smallbusiness.yahoo.com/services/index.php&.src=sbs&login=Cooldrugs7&passwd=xxxx HTTP/1.0" 999 4445 "-" "-" 82.39.175.52 - - [30/Jan/2006:15:08:35 -0200] "GET http://l1.login.dcn.yahoo.com/config/login?.redir_from=PROFILES?&.tries=1&.src=jpg&.last=&promo=&.intl=us&.bypass=&.partner=&.chkP=Y&.done=http://jpager.yahoo.com/jpager/pager2.shtml&login=big_b_mt_biker&passwd=123456 HTTP/1.0" 502 961 "-" "-" 80.144.212.33 - - [30/Jan/2006:15:08:43 -0200] "GET http://www.995members.com/members/ HTTP/1.0" 401 472 "http://www.995members.com" "Mozilla/5.0 ( Windows; U; Windows NT5.1; DigiExt )" 12.206.3.132 - - [30/Jan/2006:15:08:46 -0200] "GET http://us.a1.yimg.com/login.bjs.yahoo.com/config/login?login=big_g_&passwd=321liftoff HTTP/1.0" 200 4440 "http://www.yahoo.com/" "-" 84.109.4.111 - - [30/Jan/2006:15:08:51 -0200] "CONNECT login.icq.com:443 HTTP/1.0" 200 - "-" "-" I guess that hacker is using my SERVR APACHE to PROXY. Please, I need help urgent. I stoped service HTTPD because it. Thanks Adriano