Connections from servers own IPv6 address.

Arkaic

• May 22, 2021 05:40

We have a server running IPv6 and have noticed one account was being flooded by GoogleBot connections driving up the load on the server. The domain uses the server for DNS and does not use Cloudflare. "aaaa:aaaa:aaaa:5:ff:ff:ff:ee" is the IPv6 address of the server itself. Why might we be seeing the connections from the server rather than the real IPv6 of the visitor/bot visiting the site? aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +

• 

  andrew.n

  • May 24, 2021 06:09

  Do you use nginx, LiteSpeed, varnish or anything else on your server? what is your setup?

  0
• 

  cPRex Jurassic Moderator

  • May 24, 2021 14:02

  As @andrew.n mentioned, any type of proxying software can cause this behavior.

  0
• 

  Arkaic

  • May 24, 2021 14:19

  That was my first thought however the domain points straight to the server, no proxying software is installed. It's running plain Apache with nothing in front of it. I've just disabled IPv6 for this particular account and will check if we see the suspicious connections come via IPv4 instead.

  0

Please sign in to leave a comment.