0

I've been having issues where my Apache webserver was using up memory and bringing down the server. I increased the available memory, but now it reaches its connection limit.

Having a look at the logs, I see one IP address continuously sending POST requests for /xmlrpc.php (I am running Wordpress). I saw that was a fairly common occurence, I attempted to block it using iptables, but I'm clearly doing something wrong as I still see the requests.

More confusingly, it appears that my server is connecting to another server on port 80.

tcp        0    189 197.242.150.83:41201    45.34.6.25:80           ESTABLISHED 10296/apache2   
tcp        0    189 197.242.150.83:40870    45.34.6.25:80           ESTABLISHED 10183/apache2   
tcp        0    189 197.242.150.83:40816    45.34.6.25:80           ESTABLISHED 10127/apache2   
tcp        0    189 197.242.150.83:41035    45.34.6.25:80           ESTABLISHED 10172/apache2   
tcp        0    189 197.242.150.83:40912    45.34.6.25:80           ESTABLISHED 10201/apache2   
tcp        0    189 197.242.150.83:40820    45.34.6.25:80           ESTABLISHED 10161/apache2   
tcp        0    189 197.242.150.83:41047    45.34.6.25:80           ESTABLISHED 10237/apache2   
tcp        0    189 197.242.150.83:40888    45.34.6.25:80           ESTABLISHED 10143/apache2   
tcp        0    189 197.242.150.83:40983    45.34.6.25:80           ESTABLISHED 10225/apache2   
tcp        0    189 197.242.150.83:40900    45.34.6.25:80           ESTABLISHED 10186/apache2   
tcp        0    189 197.242.150.83:41309    45.34.6.25:80           ESTABLISHED 10301/apache2   
tcp        0    189 197.242.150.83:40881    45.34.6.25:80           ESTABLISHED 10114/apache2   
tcp        0    189 197.242.150.83:40929    45.34.6.25:80           ESTABLISHED 10196/apache2   
tcp        0    189 197.242.150.83:41226    45.34.6.25:80           ESTABLISHED 10281/apache2   
tcp        0    189 197.242.150.83:41086    45.34.6.25:80           ESTABLISHED 10213/apache2   
tcp        0    189 197.242.150.83:40965    45.34.6.25:80           ESTABLISHED 10177/apache2   
tcp        0    189 197.242.150.83:41062    45.34.6.25:80           ESTABLISHED 10219/apache2   
tcp        0    189 197.242.150.83:41299    45.34.6.25:80           ESTABLISHED 10283/apache2   
tcp        0    189 197.242.150.83:40992    45.34.6.25:80           ESTABLISHED 10241/apache2   
tcp        0    189 197.242.150.83:40809    45.34.6.25:80           ESTABLISHED 10153/apache2   
tcp        0    189 197.242.150.83:40830    45.34.6.25:80           ESTABLISHED 10134/apache2   
tcp        0    189 197.242.150.83:40972    45.34.6.25:80           ESTABLISHED 10206/apache2   
tcp        0    189 197.242.150.83:41232    45.34.6.25:80           ESTABLISHED 10291/apache2   
tcp        0    189 197.242.150.83:41253    45.34.6.25:80           ESTABLISHED 10270/apache2   
tcp        0    189 197.242.150.83:41150    45.34.6.25:80           ESTABLISHED 10284/apache2   
tcp        0    189 197.242.150.83:40942    45.34.6.25:80           ESTABLISHED 10220/apache2   
tcp        0    189 197.242.150.83:41054    45.34.6.25:80           ESTABLISHED 10248/apache2   
tcp        0    189 197.242.150.83:41002    45.34.6.25:80           ESTABLISHED 10169/apache2   
tcp        0    189 197.242.150.83:40835    45.34.6.25:80           ESTABLISHED 10115/apache2   
tcp        0    175 197.242.150.83:35562    51.254.203.153:80       ESTABLISHED 10230/apache2   
tcp        0    189 197.242.150.83:40750    45.34.6.25:80           ESTABLISHED 10110/apache2   

Any ideas what could be going on?

5
  • 3
    Whenever possible, do not obfuscate. It may be possible to determine what is going on, knowing the actual IP addresses being contacted. Jan 25, 2016 at 20:25
  • I'll edit it now. Jan 25, 2016 at 20:26
  • @MichaelHampton Thanks, I've updated with original IPs. Jan 25, 2016 at 20:27
  • 2
    My suspicion is that your server has been compromised and is participating in a denial of service attack against that host, since, of course, no web sites on it are responding. Nuke it from orbit; it's the only way to be sure. Jan 25, 2016 at 21:37
  • Once I blocked access to xmlrpc.php the connections to the other server stopped, so I suspect that server was POSTing a request that resulted in my server thinking it was supposed to contact the other server - perhaps a pretend reblogging? Jan 26, 2016 at 5:49

1 Answer 1

0

After some investigation, it seems that my server is being used for a Wordpress pingback DDoS attack, which were the POSTs I was seeing to xmlrpc.php.

As the URL is necessary for standard operations of Wordpress, I'm going to follow the SANS recommendations and add the filter to remove the pingback feature:

add_filter( ‘xmlrpc_methods’, function( $methods ) {
   unset( $methods['pingback.ping'] );
   return $methods;
} );

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.