0

My server is facing thousands of requests like this every minute:

**.**.***.*** - - [24/Sep/2015:17:01:14 +0200] "GET /imagefolder/someimage.jpeg HTTP/1.0" 200 19606 "-" "-" 92
**.**.***.*** - - [24/Sep/2015:17:01:14 +0200] "GET /imagefolder/someimage.jpeg HTTP/1.0" 200 5872 "-" "-" 88
**.**.***.*** - - [24/Sep/2015:17:01:14 +0200] "GET /imagefolder/someimage.jpeg HTTP/1.0" 200 9866 "-" "-" 88
**.**.***.*** - - [24/Sep/2015:17:01:14 +0200] "GET /imagefolder/someimage.jpeg HTTP/1.0" 200 5796 "-" "-" 89
**.**.***.*** - - [24/Sep/2015:17:01:14 +0200] "GET /imagefolder/someimage.jpeg HTTP/1.0" 200 4867 "-" "-" 89
**.**.***.*** - - [24/Sep/2015:17:01:14 +0200] "GET /imagefolder/someimage.jpeg HTTP/1.0" 200 55357 "-" "-" 89
**.**.***.*** - - [24/Sep/2015:17:01:14 +0200] "GET /imagefolder/someimage.jpeg HTTP/1.0" 200 5254 "-" "-" 88
**.**.***.*** - - [24/Sep/2015:17:01:14 +0200] "GET /imagefolder/someimage.jpeg HTTP/1.0" 200 5888 "-" "-" 88
**.**.***.*** - - [24/Sep/2015:17:01:14 +0200] "GET /imagefolder/someimage.jpeg HTTP/1.0" 200 7973 "-" "-" 88
**.**.***.*** - - [24/Sep/2015:17:01:14 +0200] "GET /imagefolder/someimage.jpeg HTTP/1.0" 200 6401 "-" "-" 88
**.**.***.*** - - [24/Sep/2015:17:01:11 +0200] "GET /404 HTTP/1.0" 200 21704 "-" "-" 44

(XX.XX.XXX.XXX is the server IP)

They point to a different file every time but allways to the same folder and allways from the server IP.

I've checked all the "cron" files in the server and none can do those types of HTTP requests. Does anybody know it there's some kind of attack that can do this even if it's from my server's IP?

user3323610
  • 9
  • 2

1 Answers1

0

Linux, Unix and even mswindows have the programming netstat which, with the right options and privileges will tell you what programming is associated with the local end of a socket.

symcbean
  • 47,736
  • 6
  • 59
  • 94