Strange issue with 74.125.79.118

Question

After frequent crashes of our Linux server, the analysis found that the server is led to collapse by a huge number of connections to the ip 74.125.79.118 departing from php scripts of the hosted web sites.

After a depth analysis of the files I don't believe there is any malware on the server.

the IP 74.125.79.118 is Google. I realize after a Google search that the connections to this ip are generated by embedded video from youtube on web sites.

But I don't understand how this type of behavior can lead to the collapse the server and the uniqueness of the situation leads me to think that the situation is far from being attributable only to Google and Youtube.

Also I've found that blocking connections from eth0 to 74.125.79.118:80 don't solve the issue, but if I stop DNS traffic from eth0 to internet,connections to 74.125.79.118 stops.

I'm really confused about this. Any suggestion?

Answer 1

I've run a scan with Clamav.It seems that a bad script cause this headache. Solved. Thanks.

Answer 2

Well, embedded video is downloaded by the client (usually the user browser). The fact that your server is downloading from youtube seems to indicate that some script is doing it (maybe for caching purposes).

You can try grepping the ip and/or youtube.com to locate the script that do this and, if it violates your TOS, then you can suspend the user/ask him to eliminate the script.

BTW, the fact that blocking dns stops this behaviour indicates that the scripts use the FQDN and not the ip you're seeing. So you can start with a grep youtube.com to see if something pops up.

EDIT

Sorry i forgot, the fact that the server crashes seems to indicate that the resource used are very high. Is it a VirtualMachine or a real server?