Apache - Very high load/bandwidth and unusual pattern of requests

Question

I am a web developer and have this server that's being used as a development machine of sorts. So, my experience with Apache is that I can fiddle around and get basic stuff done / google stuff to get the answers I need.

Over the weekend, we had a lot of load on the server to the order of 1000 times the average bandwidth usage. My Apache access logs has lines and lines that look similar to below.

81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/2011/10/a.jpg HTTP/1.0" 200 1671717 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/2011/10/b.jpg HTTP/1.0" 200 2682375 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/2011/07/c.jpg HTTP/1.0" 200 1009591 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/d.jpg HTTP/1.0" 200 365209 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/e.jpg HTTP/1.0" 200 410225 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/2011/10/b.jpg HTTP/1.0" 200 2682375 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/f.jpg HTTP/1.0" 200 446529 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/g.jpg HTTP/1.0" 200 2727018 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/h.jpg HTTP/1.0" 200 2504361 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/i.jpg HTTP/1.0" 200 520036 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/j.jpg HTTP/1.0" 200 2589152 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/j.jpg HTTP/1.0" 200 4665478 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/2011/07/c.jpg HTTP/1.0" 200 1009591 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/k.jpg HTTP/1.0" 200 1936692 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/l.jpg HTTP/1.0" 200 2777877 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/eels.jpg HTTP/1.0" 200 2451371 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/cows91.jpg HTTP/1.0" 200 1297337 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/m.jpg HTTP/1.0" 200 2551047 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/n.jpg HTTP/1.0" 200 2977841 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/e.jpg HTTP/1.0" 200 410225 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:15 +0200] "GET /wp-content/uploads/photos/o.jpg HTTP/1.0" 200 1999738 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/photos/p.jpg HTTP/1.0" 200 1994689 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/photos/d.jpg HTTP/1.0" 200 365209 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/2011/10/a.jpg HTTP/1.0" 200 1671717 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/2011/10/b.jpg HTTP/1.0" 200 2682375 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/2011/07/c.jpg HTTP/1.0" 200 1009591 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/photos/d.jpg HTTP/1.0" 200 365209 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/photos/e.jpg HTTP/1.0" 200 410225 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/2011/10/a.jpg HTTP/1.0" 200 1671717 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/2011/10/b.jpg HTTP/1.0" 200 2682375 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/2011/07/c.jpg HTTP/1.0" 200 1009591 "-" "-"
81.12.34.56 - - [30/Oct/2011:01:08:16 +0200] "GET /wp-content/uploads/photos/d.jpg HTTP/1.0" 200 365209 "-" "-"

The same set of images are being requested over and over again by my own server! Also, yes the user agent is just a dash.

This downloading of files starts again as soon as I restart the server.
I found a couple of lines in access log where /feed is being requested by the user agent "-" "Apple-PubSub/65.28". I checked the user agent and this seems to be someone asking their Mac OS to manage their feeds.
The site has been built using WordPress. However, there are no plugins etc. installed.
I am using the functions getimagesize and the library timthumb (Php). Could any of those be causing these issues?

81.12.34.56 is the only source ? `iptables -A INPUT -s 81.12.34.56 -j DROP` — Adrien P., Oct 31 '11 at 14:48
But, 81.12.34.56 is also my server's IP address - the server on which this app is hosted. Adding it to IP tables will block the requests - but not solve the problem I'm having. — Adhip Gupta, Oct 31 '11 at 14:52
Very strange ! Don't know what appending, but be careful with timthumb library, look here: http://wpcandy.com/reports/timthumb-security-vulnerability-discovered — Adrien P., Oct 31 '11 at 17:58

Apache - Very high load/bandwidth and unusual pattern of requests

0 Answers0