Join Log in
Score:0
fraxool avatar Server

Lots of suspicious GET requests that overload my CPU

gb flag
fraxool

I have a DigitalOcean droplet that hosts a small website with pretty much no traffic. Yesterday, I received an alert that my CPU was over 95%. Normally it runs between 1% to 5%. In the "bandwidth" chart on my DigitalOcean dashboard, the outbound traffic suddenly increased by a lot as seen in this screenshot :

Outbound Traffic

Outbound traffic means that it's my server that is sending the requests outside, am I right?

I logged in through SSH to check what was going on and using the following command :

sudo tcpdump -s 0 -A 'tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x47455420'

I see lots of suspicious GET requests, for example :

GET http://www.youcha.net/?fmfp0cslczu HTTP/1.1
Host: www.youcha.net
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
user-agent: Baiduspider-image+(+http://www.baidu.com/search/spider.htm)
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-HK,zh;q=0.9,en;q=0.8,zh-CN;q=0.7,en-US;q=0.6
Cache-Control: max-age=0
Connection: keep-alive

GET https://www.06681.com/mhgg?d2i6luc5eo8 HTTP/1.1
Host: www.06681.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
user-agent: Baiduspider-image+(+http://www.baidu.com/search/spider.htm)
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-HK,zh;q=0.9,en;q=0.8,zh-CN;q=0.7,en-US;q=0.6
Cache-Control: max-age=0
Connection: keep-alive

Is it what is causing the CPU to run high? I could simply recreate a new droplet but I would really like to know the origin of this problem and how to fix it so it does not occur again in the future. Do you have an idea of what is the problem here?

120
0 + 0
php
Score:0
Arstan avatar Server
ph flag
Arstan

What kind of applications do you run? Web server? What stack do you have?

Did you follow Ubuntu initial setup recommendations at DO Community Tutorials?

0 + 0
Nikita Kipriyanov avatar
za flag
Nikita Kipriyanov
This does not answer the question. It is clear the question could miss some information; when you become more approved member of the community, you'll be able to use *comments* to request a clarifications to the question. Answer is not the right place to request a clarification; this is the answer, the explanation of steps one need to perform to resolve described problem. [Here](https://serverfault.com/help/how-to-answer) are suggestions on how to write a good answer.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.