I have an Apache2 instance that started receiving hundreds of requests/s for some reason, for all sorts of domains that are not hosted here. There is nothing public running on it.
Here's an excerpt of the access.log: https://gist.github.com/d9edfc546ca77d17b1df
Facts of interest:
- bind9 was installed on it for a few days, but is not running anymore
- recently switched to a static IP
- there is a public subdomain (i.e. xxx.domain.com) pointing to the machine
- ports 22, 80, and a few others forwarded from the router
iftop shows many active connections to
unn-46-234-119-111.cloudee.eu:64526 dynamicip-94-181-151-242.pppoe.penza.ertelecom.ru:64219 c-71-228-220-228.hsd1.tn.comcast.net:51688 89-179-33-252.broadband.corbina.ru:62767 static-98-114-145-42.phlapa.fios.verizon.net:32476
and other variations of these, all to ports that are blocked on the router.
PID 0 for those...
0 root ..1:80-220.127.116.11:64063 0.000 0.000 KB/sec