Please whitelist cPanel in your adblocker so that you’re able to see our version release promotions, thanks!

The Community Forums

Interact with an entire community of cPanel & WHM users!
  1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

High Cpu usage by Httpd .. seems attack

Discussion in 'Security' started by webstyler, Feb 11, 2010.

  1. webstyler

    webstyler Well-Known Member

    Joined:
    Nov 20, 2003
    Messages:
    439
    Likes Received:
    0
    Trophy Points:
    166
    Hi

    many process httpd with high cpu usage

    all to one specify server account with

    POST /images/yahoo/index.php HTTP/1.1

    We have check but not exist dir yahoo under /images of these user..

    We have also check if there is any .htaccess or .php but nothing, only images here..

    Any idea ??

    and why POST ?
     
  2. webstyler

    webstyler Well-Known Member

    Joined:
    Nov 20, 2003
    Messages:
    439
    Likes Received:
    0
    Trophy Points:
    166
    Hello

    today start with same issue

    high cpu usage by request
    "POST /images/yahoo/index.php HTTP/1.1"

    There isn't page or bug, this call give a "not found error"

    but take a lot of resources

    20356 nobody 4 73.2 2.0 /usr/local/apache/bin/httpd -k start -DSSL

    any idea to how stop this ?
     
  3. hostmedic

    hostmedic Well-Known Member

    Joined:
    Apr 30, 2003
    Messages:
    544
    Likes Received:
    0
    Trophy Points:
    166
    Location:
    Washington Court House, Ohio, United States
    cPanel Access Level:
    DataCenter Provider
    which account?

    Do you know which account is causing this?

    also - are the calls always coming from the same ip address?

    If so - you can

    a. put a block on that ip
    b. investigate a bit more... what might be happening
     
  4. webstyler

    webstyler Well-Known Member

    Joined:
    Nov 20, 2003
    Messages:
    439
    Likes Received:
    0
    Trophy Points:
    166
    yes

    no, many IP always different


    We have only this data :
    - account user
    - page requested and method: POST /images/yahoo/index.php HTTP/1.1

    under account there isn't this dir.. think that request get only a "not found error" but CPU is really hight

    :/

    also today we have same issue
     
  5. webstyler

    webstyler Well-Known Member

    Joined:
    Nov 20, 2003
    Messages:
    439
    Likes Received:
    0
    Trophy Points:
    166
    :O

    I have suspended account

    But still to have same problem for POST request to this account

    :/ ??
     
Loading...

Share This Page