Server IP accessing hosted website and generating traffic

[Takito]

Hello,

I have little problem. My client has a website hosted which was working fine but suddenly it started to "eat" up all the bandwidth. From the logs I see that the server IP is trying to access certain files non-stop(screenshot attached). Last month I had the same problem with the other client.
Is it solely wordpress issue? Or it has something to do with cPanel? And how to stop this?

Thank you



stats for january

 

[Infopro]

Does this account have an actual domain associated with it or are you using mod_userdir tweak setting in WHM?
Apache mod_userdir Tweak - Documentation - cPanel Documentation

Security Implications
We strongly recommend that you restrict mod_userdir functionality for most of your users. There are potential security issues that mod_userdir can expose.

• A user's content can be accessed using a domain name and SSL certificate that belongs to another user. This can potentially be used for phishing attacks or other malicious content, that appears to be hosted under the target domain.
• Bandwidth is accounted for per-host rather than per-user. If a user's content is accessed via mod_userdir, then their bandwidth usage will not be recorded correctly. This can also potentially allow for one user to use the bandwidth of another.

 

[Takito]

Hello Infopro,

mod_userdir Protection is enabled for all users except DefaultHost (nobody).

The account have an actual domain. But it is an addon domain, if it matters.

I searched through web and haven't found any useful information so far

 

[Takito]

so, I tried to disable plugins(renaming folders) - nothing happened.
When I have created a requested file that was not in place then it started to request only it(there was a redirect when the file doesn't exist).
So now I have lowered the traffic but still 1000 requests per 3 minutes are hitting the file


Talked to Wordpress developer, he wasn't able to help me -_-

 

[Infopro]

so, I tried to disable plugins(renaming folders) - nothing happened.

What's the plugin called? I googled for that file name: cam-bcn000M.jpg and the results suggest a file converter of some sort. No clue if this is your issue or not of course