Connections from servers own IPv6 address.

Arkaic

Active Member
Jun 23, 2015
39
8
58
United Kingdom
cPanel Access Level
Root Administrator
We have a server running IPv6 and have noticed one account was being flooded by GoogleBot connections driving up the load on the server.

The domain uses the server for DNS and does not use Cloudflare.

"aaaa:aaaa:aaaa:5:ff:ff:ff:ee" is the IPv6 address of the server itself.

Why might we be seeing the connections from the server rather than the real IPv6 of the visitor/bot visiting the site?


aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:18 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:22 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:22 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:18 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:18 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:21 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
aaaa:aaaa:aaaa:5:ff:ff:ff:ee - - [22/May/2021:11:32:20 +0100] "GET /wp-content/uploads/2017/01/xxxx-holidaypark-logo-600.jpg HTTP/2.0" 503 - "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +What Is Googlebot | Google Search Central | Google Developers)"
 
Last edited by a moderator:

andrew.n

Well-Known Member
Jun 9, 2020
619
179
43
EU
cPanel Access Level
Root Administrator
Do you use nginx, LiteSpeed, varnish or anything else on your server? what is your setup?
 
  • Like
Reactions: cPRex

Arkaic

Active Member
Jun 23, 2015
39
8
58
United Kingdom
cPanel Access Level
Root Administrator
That was my first thought however the domain points straight to the server, no proxying software is installed. It's running plain Apache with nothing in front of it.

I've just disabled IPv6 for this particular account and will check if we see the suspicious connections come via IPv4 instead.
 
  • Like
Reactions: andrew.n and cPRex