The following is an excerpt of an apache access log output during the last 24 hours. http://pastebin.com/imtJfvLE
- The requests come from more than 5733 unique IP addresses
- ~2 requests per second, totaling ~5GB log data per day
- From metrics, it is shown that outbound traffic is about one order of magnitude larger than inbound traffic, due to these requests.
The assumption is that this is an attack of some sort, or a usage of my server for some reason. But I cannot come to a conclusion as to what its purpose is.
Currently I have written an apache RewriteRule to redirect all of this traffic to a nonexistent domain. At the least, if this is some sort of participation in an odd DDOS attack, it will receive a 301 in return, thus significantly reducing packet size. Ideally I would implement some type of layer 7 firewall that would simply drop the packets, but seeing as this is a Azure VM, that is difficult.
Would you be able to help me determine the attack's purpose, and if possible, how to mitigate it?