1

I'm having a huge problem with my website due to a weird spike on hits.

Today, i'm getting several hundred hits. Normally, i get a lot less, and they are from me country.

Today's hits are from every country on the map. They are all direct hits (no referral) and they hit my main page. Most of them stay for 0 seconds and then leave. They are not bots and they seem to originate from legitimate IPs. But those users couldn't possibly know the address of my website (and type it on their browser).

This is giving me huge problems, since it causes high CPU usage on my web hosting. So, i have to find a solution fast.

Examples:

78.225.147.100 - - [04/Jul/2014:19:48:23 +0300] "GET / HTTP/1.1" 301 138 "-" "Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)"
78.225.147.100 - - [04/Jul/2014:19:48:23 +0300] "GET / HTTP/1.1" 200 21192 "-" "Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)"
181.196.13.128 - - [04/Jul/2014:19:50:50 +0300] "GET / HTTP/1.1" 301 138 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
181.196.13.128 - - [04/Jul/2014:19:50:51 +0300] "GET / HTTP/1.1" 200 21192 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
77.105.21.227 - - [04/Jul/2014:20:07:32 +0300] "GET / HTTP/1.1" 301 138 "-" "Mozilla/5.0 (compatible; MSIE 9.11; Windows NT 6.1; Trident/6.0)"
77.105.21.227 - - [04/Jul/2014:20:07:33 +0300] "GET / HTTP/1.1" 200 21192 "-" "Mozilla/5.0 (compatible; MSIE 9.11; Windows NT 6.1; Trident/6.0)"

I believe that it's some kind of malware that has infected thousands of computers and, for some reason, those computers are now hitting my website.

So, any help is appreciated!

closed as unclear what you're asking by TildalWave, Mark, Gilles, Xander, Adi Jul 6 '14 at 9:20

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • put nginx or varnish as short-term cache infront of it, problem solved – that guy from over there Jul 4 '14 at 22:41
  • so how does it come, one GET / returns a 301, anotherone returns a 200 OK??? looks fishy – that guy from over there Jul 4 '14 at 22:43
  • What kind of help do you expect? Those log samples all redirect (301) from one root back to probably another root (say no subdomain to www, but you didn't set your server up to log that). That's how you have your server setup, 301 is not a request but a response. That can explain probably nearly half of this "increased traffic", and redirect would drop the referer from subsequent request. None of these IPs are blacklisted in any of the public CBLs that I can see. Use e.g. ipvoid.com to check for that. So what's the question? How to setup a web server and interpret its logs? – TildalWave Jul 4 '14 at 22:45
  • It seems like you are targeted by a distributed denial-of-service attack originating from a botnet. – Philipp Jul 4 '14 at 22:52
  • 2
    @Philipp C'mon, only hundreds and with GET requests? My guess, OP added the site to some link exchange, forgot all about it, and is getting a bit more traffic from HTTPS enabled sites that don't include referer. Some of these are spiders, some legit users, and OP hasn't knowledge to distinguish between them. Only one IP in the list looks "fishy", and even that's some proxy on SAS France. There's 8192 such IPs in that same CIDR range. Hardly anything to worry about. – TildalWave Jul 4 '14 at 22:56
0

A few hundred hits per day should not significantly affect your CPU usage.

Here are some things you can do to try to diagnose the problem:

  • Change your IP address or use a dynamic IP address. This will tell you whether you are being targeted by domain name or by IP address (the latter being more likely to be an automated attack).
  • Take down your web server for a day or two and then bring it back up. Does the traffic return immediately?
  • Pick some of the IP addresses and track them down. See if you can contact a local sysadmin to ask about the traffic.
0

If it is shared hosting try to enable cloudflare which is supported by many hosting providers in CPanel. Then enable threat control. It will reduces the CPU usage by reducing attacks from know bad IPs.

BTW It is highly recommended to take access and error logs and analyze with a log analyzer. Then your eye will see patterns.

Not the answer you're looking for? Browse other questions tagged or ask your own question.