0

our server crashed yesterday for the 1 time after one whole year. So i checked the logs and find some strange things. There is one ip that make about 450 individual site-requests in a 12 min period of time. We running an online shop ... so hiting 450 sites dont seems like a normal human behavior. Is this what i can consider as a ddos or whats going on here?

And that many requests bring our server to crash with this error message

upstream prematurely closed connection while reading response header from upstream

Here some excerpt from 2 logs files:

proxy_error_log

access_ssl_log

Edit1:

This looks also interesting ...

Location/Hostname

80.87.117.22

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Googlebot/2.1;  http://www.google.com/bot.html) Safari/537.36

Mozilla/5.0 (compatible; Googlebot/2.1; startmebot/1.0;  https://start.me/bot)

Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Mwendo/1.1.5 Safari/537.21

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36

greetings from poland!

Improve this question
3
  • 1
    Check the syslog/dmesg for memory or hardware messages. Have you done any software updates recently?
    – Christian
    Dec 3, 2018 at 10:01
  • I checked it already and there are no hardware messages and i dont done any software updates recently on this server. Btw its the second time this happen from the exact same ip.
    – Kuba
    Dec 3, 2018 at 10:07
  • When you say 'crashed', what happened? Did it reboot or did the web server stop responding?
    – Christian
    Dec 3, 2018 at 16:54

1 Answer 1

Reset to default
3

No, by definition DDoS mean Distributed.... so, much more than one IP are involved. In your case you can (eventually) name it DoS (Denial of Service).

But having 450 requests for 12 minutes (720 seconds) make less than one request per second. And those requests include such for images, for css and iframes and so on. So for me this can't be counted for DoS attack. Think about having hundreds per second or more hits (or much much more) for DoS or DDoS attach

Probably the browser of this user have activated some kind of prefetch to download in advance sibling pages of current loaded page to speedup user experience when user clik on link on current page.

Improve this answer
7
  • For the 450 requests i only counted the straight "html" requests wihtout any css, js, image files and so on. And all these requests are distributed within this 12 min. So its about 30-40 requests per second from this ip, then a pause a couple seconds and again 30-40 requests per second. So u dont think this guy/ip has no bad intentions?
    – Kuba
    Dec 3, 2018 at 9:55
  • @Kuba, you should check if from the same IP you have other requests (beside this block). Also to check the local time of user (based on request time and IP timezone). Also some similar request blocks from different IP... This can give you some idea if its real DoS or just strange hit
    – Romeo Ninov
    Dec 3, 2018 at 10:12
  • 1
    Timezone/country is same as the server. And this guy/ip crashed 2 times our server and has not much more requests beside that. So maybie he has bad intentions or he use some strange addons like u said, even if dont know addons like that. I think i go to block this ip and wait what happens the next days/weeks.
    – Kuba
    Dec 3, 2018 at 10:29
  • @Kuba, as first step this is wise idea. Nevertheless try to understand why your server crash. IMHO those requests show you have something to update, improve, tune.
    – Romeo Ninov
    Dec 3, 2018 at 10:31
  • I know that and i will improve the server-settings (apache and nginx) of course! But beside that i just wanted to know/undersatnd why there so "many" requests from one ip ;)
    – Kuba
    Dec 3, 2018 at 10:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .