I noticed something weird in our server telemetry today where it showed that one of our servers is having a very steady incoming amount of traffic where it normally is very irregular.
When examining the apache server status it shows the following logs: (url replaced by example.com)
Srv PID Acc M CPU SS Req Conn Child Slot Client VHost Request 1-0 3438 0/1/6295 _ 0.01 7 29 0.0 0.00 211.21 [CLIENT IP] example.com:443 NULL 2-0 3439 0/4/6901 _ 0.03 0 1 0.0 0.06 248.54 [CLIENT IP] example.com:443 NULL
There is a lot of requests coming in where the request parameter is
NULL where on other requests the request is some form of the following:
GET / HTTP/1.0
Could these connection attempts be malicious? I can't figure out what kind of purpose these would serve to an attacker. It doesn't even come close to the server it's capacity just a steady 5 mbps incoming traffic stream.