Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Shells Virtual Desktop
BMail.ag - Secure Email Service
Server.net
CPLicense.net
VPS Server
Buy VPN
Vultr
VMs for AI
HostDare
HostDare
ReliableSite White-Label Dedicated Hosting for Resellers
InterServer VPS
BMail.ag - Secure Email Service
Best VPN
High-Performance Bare Metal Server Solutions
Karvl.com
Server Mania Cloud Hosting
DataWagon Hosting
AlphaVPS Hosting
Evoxt.com
Clouvider
VPS Hosting with NVMe
Residential IPs in the US & 4G Mobile Proxies in EU & US with Unlimited Bandwidth
ReliableSite White-Label Dedicated Hosting for Resellers
Rabisu - Hosting Solutions
Shells Virtual Desktop

Categories

In this Discussion

Home › Help
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

2a05:dfc1:5801:3::d Wget requests hitting my site hard!! Help needed

JasonMJasonM Member
in Help

Hi, I was on holiday for sometime and found out my site got hit from this particular ip
2a05:dfc1:5801:3::d
from June 6th onward.

Since my site is behind Cloudflare I just put that ip in block list and it stopped the inflated traffic. The CF stats shows the following:

the ip sent 578.76K requests in 24 hours to my site's various pages.

request to html pages were cached by CF and served, but other files like json, or dynamic files were bypass by CF and hit my origin causing site to slow down as it hit CPU limits.

From the above screenshots, it was Wget request by method HEAD. not even GET requests.

Can anyone shed light on this? there is no User-agent associated with it. IP belongs to DataForest in Germany.

As of today the site is working back to normal as I've blocked the ip range.

Comments

  • Motion3549Motion3549 Member

    Do you have crowdsec enable?

    Thanked by 1JasonM
  • MMMMMMMMMMMM Member

    On my case, I've been receiving a lot of HEAD requests from OVH and Hetzner IPs (Sometimes from Huawei Cloud), so I now block all HEAD requests and it's gone now.

    Thanked by 2JasonM itzgeo
  • emg88emg88 Member

    Contact the abuse email about it, I looked it up one says it's dataforest and another said it was [email protected] (Portugal)

    Thanked by 2JasonM tentor
  • IntelpentiummIntelpentiumm Member

    Wordpress?

  • DetruireDetruire Member

    @emg88 said:
    Contact the abuse email about it, I looked it up one says it's dataforest and another said it was [email protected] (Portugal)

    WNDP - WebNegócio Lda? Did @jar acquire that along with MyW?

  • varwwwvarwww Member

    you are lucky the AI bots have not started hitting your site yet.

    Thanked by 4JasonM ariq01 tentor jolo22
  • FubukiboxFubukibox Member

    @JasonM said:
    Hi, I was on holiday for sometime and found out my site got hit from this particular ip
    2a05:dfc1:5801:3::d
    from June 6th onward.

    Since my site is behind Cloudflare I just put that ip in block list and it stopped the inflated traffic. The CF stats shows the following:

    the ip sent 578.76K requests in 24 hours to my site's various pages.

    request to html pages were cached by CF and served, but other files like json, or dynamic files were bypass by CF and hit my origin causing site to slow down as it hit CPU limits.

    From the above screenshots, it was Wget request by method HEAD. not even GET requests.

    Can anyone shed light on this? there is no User-agent associated with it. IP belongs to DataForest in Germany.

    As of today the site is working back to normal as I've blocked the ip range.

    The ipv6 belongs in Portugal, not Germany but still uses the same ASN (AS58212). I usually have CloudFlare to block all hosting/VPN/proxy servers from reaching my main server

    Thanked by 1JasonM
  • JasonMJasonM Member

    @Intelpentiumm said: Wordpress?

    yes

  • zGatozGato Member
    edited June 2025

    @Fubukibox said:

    @JasonM said:
    Hi, I was on holiday for sometime and found out my site got hit from this particular ip
    2a05:dfc1:5801:3::d
    from June 6th onward.

    Since my site is behind Cloudflare I just put that ip in block list and it stopped the inflated traffic. The CF stats shows the following:

    the ip sent 578.76K requests in 24 hours to my site's various pages.

    request to html pages were cached by CF and served, but other files like json, or dynamic files were bypass by CF and hit my origin causing site to slow down as it hit CPU limits.

    From the above screenshots, it was Wget request by method HEAD. not even GET requests.

    Can anyone shed light on this? there is no User-agent associated with it. IP belongs to DataForest in Germany.

    As of today the site is working back to normal as I've blocked the ip range.

    The ipv6 belongs in Portugal, not Germany but still uses the same ASN (AS58212). I usually have CloudFlare to block all hosting/VPN/proxy servers from reaching my main server

    dataforest only has Germany

    Thanked by 1admax
  • JasonMJasonM Member

    @Fubukibox said: The ipv6 belongs in Portugal,

    yeah.. I checked it:
    https://bgp.he.net/ip/2a05:dfc1:5801:3::d#_whois

    Thanked by 1Fubukibox
  • JasonMJasonM Member

    @jar if that IP belongs to myw.pt.. I was myw's customer. but moved my site to another host in Feb. Why would i get W/get requests from that ip (if probably belongs to MyW/WNDP WebNegócio Lda.) now?

  • IntelpentiummIntelpentiumm Member

    @Intelpentiumm said:
    Wordpress?

    Do you still have the WP files in Jar's myw account? If yes, login to DA and rename the plugins folder to _plugins or something.

    Thanked by 1JasonM
  • e2bs2k1e2bs2k1 Member
    edited June 2025

    block all wget,curl,python, and empty useragents with cloudflare(or redirect to static page like honeypot)

    Thanked by 1JasonM
  • vovlervovler Member

    some php script running on myw?

    Thanked by 1JasonM
  • jarjar Patron Provider, Top Host, Veteran

    @JasonM said:
    @jar if that IP belongs to myw.pt.. I was myw's customer. but moved my site to another host in Feb. Why would i get W/get requests from that ip (if probably belongs to MyW/WNDP WebNegócio Lda.) now?

    I can think of a wealth of reasons. Especially if you had something running on the server against the domain and its DNS changed. Doing a wget against one’s own site to trigger wp-cron is quite common. Any chance you were doing that? Any chance it’s still running?

    Thanked by 2yoursunny emgh
  • JasonMJasonM Member

    @jar said: I can think of a wealth of reasons. Especially if you had something running on the server against the domain and its DNS changed. Doing a wget against one’s own site to trigger wp-cron is quite common. Any chance you were doing that? Any chance it’s still running?

    thanks Jar for replying and hinting. well, indeed i logged into MyW DA panel, and there are 4 Wget cron jobs running pointing to my same url that was hosted with MyW earlier. I've disabled those cron jobs, removed the IPv6 from CF firewall, and now lets see if it still sends wget requests. I hope this will resolve issue.

    Thanked by 1jar
  • cmeerwcmeerw Member

    @JasonM said: well, indeed i logged into MyW DA panel, and there are 4 Wget cron jobs running pointing to my same url that was hosted with MyW earlier.

    So what were those cron jobs supposed to do and why did they end up sending 578.76K requests in 24 hours?

    Thanked by 3Xrmaddness sillycat tentor
  • allthemtingsallthemtings Member, Megathread Squad

    @cmeerw said:

    @JasonM said: well, indeed i logged into MyW DA panel, and there are 4 Wget cron jobs running pointing to my same url that was hosted with MyW earlier.

    So what were those cron jobs supposed to do and why did they end up sending 578.76K requests in 24 hours?

    24000 rsync backups an hour, obviously

    Thanked by 2barbaros emgh
  • raindog308raindog308 Administrator, Veteran

    I warned you all that this IPv6 stuff was dangerous...

    Thanked by 7allthemtings khalequzzaman Xrmaddness itzgeo gsea4 JerryHou emgh
  • FritzFritz Veteran

    @JasonM said:

    @jar said: I can think of a wealth of reasons. Especially if you had something running on the server against the domain and its DNS changed. Doing a wget against one’s own site to trigger wp-cron is quite common. Any chance you were doing that? Any chance it’s still running?

    thanks Jar for replying and hinting. well, indeed i logged into MyW DA panel, and there are 4 Wget cron jobs running pointing to my same url that was hosted with MyW earlier. I've disabled those cron jobs, removed the IPv6 from CF firewall, and now lets see if it still sends wget requests. I hope this will resolve issue.

    So you were the culprit.

  • yoursunnyyoursunny Member, IPv6 Advocate

    @raindog308 said:
    I warned you all that this IPv6 stuff was dangerous...

    Wait till you deploy IPv9.

  • XrmaddnessXrmaddness Member

    @yoursunny said:

    @raindog308 said:
    I warned you all that this IPv6 stuff was dangerous...

    Wait till you deploy IPv9.

    I had Google Veo 3 hallucinate on what that might look like:
    https://files.catbox.moe/l2hrpg.mp4

    Thanked by 1yoursunny
  • hades_corpshades_corps Member

    @Fritz said:

    @JasonM said:

    @jar said: I can think of a wealth of reasons. Especially if you had something running on the server against the domain and its DNS changed. Doing a wget against one’s own site to trigger wp-cron is quite common. Any chance you were doing that? Any chance it’s still running?

    thanks Jar for replying and hinting. well, indeed i logged into MyW DA panel, and there are 4 Wget cron jobs running pointing to my same url that was hosted with MyW earlier. I've disabled those cron jobs, removed the IPv6 from CF firewall, and now lets see if it still sends wget requests. I hope this will resolve issue.

    So you were the culprit.

    The calls come from inside the house!

  • TimboJonesTimboJones Member
    edited June 2025

    @JasonM said:
    @jar if that IP belongs to myw.pt.. I was myw's customer. but moved my site to another host in Feb. Why would i get W/get requests from that ip (if probably belongs to MyW/WNDP WebNegócio Lda.) now?

    By moved, do you just mean copy and didn't remove from myw?

    Edit: answered already.

Sign In or Register to comment.