I noticed something weird in our server telemetry today where it showed that one of our servers is having a very steady incoming amount of traffic where it normally is very irregular.

When examining the apache server status it shows the following logs: (url replaced by example.com)

Srv PID Acc M   CPU SS  Req Conn    Child   Slot    Client  VHost   Request
1-0 3438    0/1/6295    _   0.01    7   29  0.0 0.00    211.21  [CLIENT IP] example.com:443 NULL
2-0 3439    0/4/6901    _   0.03    0   1   0.0 0.06    248.54  [CLIENT IP] example.com:443 NULL

There is a lot of requests coming in where the request parameter is NULL where on other requests the request is some form of the following: GET / HTTP/1.0

Could these connection attempts be malicious? I can't figure out what kind of purpose these would serve to an attacker. It doesn't even come close to the server it's capacity just a steady 5 mbps incoming traffic stream.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.