Looking at the way the proxy was created on the Nginx server, it seems he's created an open http proxy that's asking to be abused. Anyone could make a curl requ

Looking at the way the proxy was created on the Nginx server, it seems he's created an open http proxy that's asking to be abused. Anyone could make a curl request to that /apps/bbc-news/proxy uri and pass whatever URL they wanted to hit via the x_bbc_url http header. Doing this, any request they make would appear to come from the whitherapps.com (or whatever) domain. I can see the 4chan guys having a field day with this posting spam to boards their own IPs have been banned from. Seems like the server should only allow http proxying to a white list of domains, or better yet, a white list of urls.