My Apache seems to be connecting to other servers?

Question

I've been having issues where my Apache webserver was using up memory and bringing down the server. I increased the available memory, but now it reaches its connection limit.

Having a look at the logs, I see one IP address continuously sending POST requests for /xmlrpc.php (I am running Wordpress). I saw that was a fairly common occurence, I attempted to block it using iptables, but I'm clearly doing something wrong as I still see the requests.

More confusingly, it appears that my server is connecting to another server on port 80.

tcp        0    189 197.242.150.83:41201    45.34.6.25:80           ESTABLISHED 10296/apache2   
tcp        0    189 197.242.150.83:40870    45.34.6.25:80           ESTABLISHED 10183/apache2   
tcp        0    189 197.242.150.83:40816    45.34.6.25:80           ESTABLISHED 10127/apache2   
tcp        0    189 197.242.150.83:41035    45.34.6.25:80           ESTABLISHED 10172/apache2   
tcp        0    189 197.242.150.83:40912    45.34.6.25:80           ESTABLISHED 10201/apache2   
tcp        0    189 197.242.150.83:40820    45.34.6.25:80           ESTABLISHED 10161/apache2   
tcp        0    189 197.242.150.83:41047    45.34.6.25:80           ESTABLISHED 10237/apache2   
tcp        0    189 197.242.150.83:40888    45.34.6.25:80           ESTABLISHED 10143/apache2   
tcp        0    189 197.242.150.83:40983    45.34.6.25:80           ESTABLISHED 10225/apache2   
tcp        0    189 197.242.150.83:40900    45.34.6.25:80           ESTABLISHED 10186/apache2   
tcp        0    189 197.242.150.83:41309    45.34.6.25:80           ESTABLISHED 10301/apache2   
tcp        0    189 197.242.150.83:40881    45.34.6.25:80           ESTABLISHED 10114/apache2   
tcp        0    189 197.242.150.83:40929    45.34.6.25:80           ESTABLISHED 10196/apache2   
tcp        0    189 197.242.150.83:41226    45.34.6.25:80           ESTABLISHED 10281/apache2   
tcp        0    189 197.242.150.83:41086    45.34.6.25:80           ESTABLISHED 10213/apache2   
tcp        0    189 197.242.150.83:40965    45.34.6.25:80           ESTABLISHED 10177/apache2   
tcp        0    189 197.242.150.83:41062    45.34.6.25:80           ESTABLISHED 10219/apache2   
tcp        0    189 197.242.150.83:41299    45.34.6.25:80           ESTABLISHED 10283/apache2   
tcp        0    189 197.242.150.83:40992    45.34.6.25:80           ESTABLISHED 10241/apache2   
tcp        0    189 197.242.150.83:40809    45.34.6.25:80           ESTABLISHED 10153/apache2   
tcp        0    189 197.242.150.83:40830    45.34.6.25:80           ESTABLISHED 10134/apache2   
tcp        0    189 197.242.150.83:40972    45.34.6.25:80           ESTABLISHED 10206/apache2   
tcp        0    189 197.242.150.83:41232    45.34.6.25:80           ESTABLISHED 10291/apache2   
tcp        0    189 197.242.150.83:41253    45.34.6.25:80           ESTABLISHED 10270/apache2   
tcp        0    189 197.242.150.83:41150    45.34.6.25:80           ESTABLISHED 10284/apache2   
tcp        0    189 197.242.150.83:40942    45.34.6.25:80           ESTABLISHED 10220/apache2   
tcp        0    189 197.242.150.83:41054    45.34.6.25:80           ESTABLISHED 10248/apache2   
tcp        0    189 197.242.150.83:41002    45.34.6.25:80           ESTABLISHED 10169/apache2   
tcp        0    189 197.242.150.83:40835    45.34.6.25:80           ESTABLISHED 10115/apache2   
tcp        0    175 197.242.150.83:35562    51.254.203.153:80       ESTABLISHED 10230/apache2   
tcp        0    189 197.242.150.83:40750    45.34.6.25:80           ESTABLISHED 10110/apache2   

Any ideas what could be going on?

Answer 1

After some investigation, it seems that my server is being used for a Wordpress pingback DDoS attack, which were the POSTs I was seeing to xmlrpc.php.

As the URL is necessary for standard operations of Wordpress, I'm going to follow the SANS recommendations and add the filter to remove the pingback feature:

add_filter( ‘xmlrpc_methods’, function( $methods ) {
   unset( $methods['pingback.ping'] );
   return $methods;
} );