Connections from servers own IPv6 address.

A

Arkaic

Active Member
Jun 23, 2015
42
10
58
United Kingdom
cPanel Access Level
Root Administrator
We have a server running IPv6 and have noticed one account was being flooded by GoogleBot connections driving up the load on the server.

The domain uses the server for DNS and does not use Cloudflare.

"aaaa:aaaa:aaaa:5:ff:ff:ff:ee" is the IPv6 address of the server itself.

Why might we be seeing the connections from the server rather than the real IPv6 of the visitor/bot visiting the site?


aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:18 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:22 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:22 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:18 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:18 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
 
Last edited by a moderator:
andrew.n

andrew.n

Well-Known Member
Jun 9, 2020
951
352
63
EU
cPanel Access Level
Root Administrator
Do you use nginx, LiteSpeed, varnish or anything else on your server? what is your setup?
 
  • Like
Reactions: cPRex
A

Arkaic

Active Member
Jun 23, 2015
42
10
58
United Kingdom
cPanel Access Level
Root Administrator
That was my first thought however the domain points straight to the server, no proxying software is installed. It's running plain Apache with nothing in front of it.

I've just disabled IPv6 for this particular account and will check if we see the suspicious connections come via IPv4 instead.
 
  • Like
Reactions: andrew.n and cPRex
You must log in or register to reply here.
Thread starter Similar threads Forum Replies Date
T FTP connections not releasing after task completes Web Servers and Applications 1
V Lot of http/1.1 connections from Server Main IP Web Servers and Applications 1
M Loopback Connections not Enabeled Web Servers and Applications 5
V Apache status page with more 127.0.0.1 connections Web Servers and Applications 1
L Mysterious connections from 0.0.0.0 Web Servers and Applications 2
Similar threads
FTP connections not releasing after task completes
Lot of http/1.1 connections from Server Main IP
Loopback Connections not Enabeled
Apache status page with more 127.0.0.1 connections
Mysterious connections from 0.0.0.0
Top Bottom