multiple entries in apache access log

multiple entries in apache access log

by Manish Datt -
Number of replies: 7
Hi,

In the apache access log for bitnami moodle on GCP, there are multiple entries (add every few seconds) as given below. I would appreciate any pointers to resolve this issue. 

52.70.240.171 - - [17/Mar/2024:17:34:25 +0530] "GET /lib/requirejs.php/1684130153/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+b.imageUrl(%22t/expanded%22)+%22/%22/%22 HTTP/1.1" 200 315815

52.70.240.171 - - [17/Mar/2024:17:34:26 +0530] "GET /lib/requirejs.php/1684130153/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.imageUrl(%22t/expanded%22)+%22/%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.imageUrl(%22t/expanded%22)+%22/%22/ HTTP/1.1" 200 315815

23.22.35.162 - - [17/Mar/2024:17:34:26 +0530] "GET /lib/requirejs.php/1684130153/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+h.link+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+b.params.cookiePolicyUrl+%22/%22%22+h.link+%22/%22%22+b.imageUrl(%22t/collapsed%22)+%22/%22/%22 HTTP/1.1" 200 315815

Thanks in advance for your help.
Average of ratings: -
In reply to Manish Datt

Re: multiple entries in apache access log

by Benjamin Ellis -
Hi,

Why do you think it is a problem?  The return status is 200 (OK), so the requests have been successfully served.
Average of ratings: -
In reply to Benjamin Ellis

Re: multiple entries in apache access log

by Manish Datt -
Well yes, the requests are being served successfully. But these requests are happening every second!! This is causing a lot of unnecessary outbound traffic. This continues even when there is no user accessing the site.
Thanks for looking into it.
Average of ratings: -
In reply to Manish Datt

Re: multiple entries in apache access log

by Ken Task -
Picture of Particularly helpful Moodlers
Both IP addresses shown ID as AmazonBots.

52.70.240.171
52-70-240-171.crawl.amazonbot.amazon

23.22.35.162
23-22-35-162.crawl.amazonbot.amazon

And you are hosted on Google.   Hmmmmm ....
Do know that GCP sites are metered and cost determined by traffic.

You could try:
https://developer.amazon.com/amazonbot

'SoS', Ken

Average of ratings:Useful (1)
In reply to Manish Datt

Re: multiple entries in apache access log

by Leon Stringer -
Picture of Core developers Picture of Particularly helpful Moodlers

I've seen these requests to a customer site who was running an older/unsupported Moodle version. As far as I could tell these repeated requests were causing the PHP-FPM service to stop responding so that the site was unavailable. I added a rule to .htaccess to block these requests and get the site up again (I'm deliberately not sharing this rule in case it's something the attacker can work around).

I tried reproducing this with the same Moodle version to determine whether it's something that's known and has been fixed but didn't get the problem in testing.

But it might be a denial of service attack specifically targeting Moodle.

Average of ratings:Useful (1)
In reply to Leon Stringer

Re: multiple entries in apache access log

by Ken Task -
Picture of Particularly helpful Moodlers
@Leon ...
Best, me thinks, to block such traffic at the network layer rather than .htaccess/moodle- which is at the application layer.
So I think investigation as to availabiliity  of firewall/network controls on that server is needed to see if  blocking can be done at that layer.  Older OS - iptables.   More modern OS's have firewalls that have zones and one could block those IP addresses by including either the specific IP address or a range of IP address in a 'drop' zone.   Any access by those IP's get dropped - no response of any kind - at the network layer ... thus before the application layer ... .htaccess/apache/moodle.

With the original posters info those 2 IP addresses are ID'd as Amazon Bots ... unforunately, moodle does use Amazon for notifications and other so one could have to be careful not to include the range of Moodle's Amazon IP addresses.   But OP could block those specific IP addresses at the network layer.

'SoS', Ken

Average of ratings: -
In reply to Ken Task

Re: multiple entries in apache access log

by Leon Stringer -
Picture of Core developers Picture of Particularly helpful Moodlers

Just to confirm, the following were the source IP addresses I was seeing:

  1. 23.22.35.162 (same as OP)
  2. 3.224.220.101
  3. 52.70.240.171 (same as OP)
Average of ratings: -
In reply to Leon Stringer

Re: multiple entries in apache access log

by Ken Task -
Picture of Particularly helpful Moodlers
3.224.220.101
;; ANSWER SECTION:
101.220.224.3.in-addr.arpa. 300    IN    PTR    3-224-220-101.crawl.amazonbot.amazon.

So it too is an amazonbot.

Whois info:
Comment:        All abuse reports MUST include:
Comment:        * src IP
Comment:        * dest IP (your IP)
Comment:        * dest port
Comment:        * Accurate date/timestamp and timezone of activity
Comment:        * Intensity/frequency (short log extracts)
Comment:        * Your contact details (phone and email) Without these we will be unable to identify the correct owner of the IP address at that point in time.
Ref:            https://rdap.arin.net/registry/entity/AT-88-Z

Comment: I have tried abuse reports before ... usually result in return of bots ... and it not careful, it's really a way for the other side to confirm. sad
So ... if I find whatever is too aggressive, I block the IP or a range of IP's at the network layer.   Don't make those permanent .. reboot of server clears them ... but I have a 'reload' file to re-instate the drops.
Other than Amazon, one I see frequently is from Palo Alto ... and their whois info claims they are attempting to find out who is using their software. smile

Just be careful not to block yourself!   Done that before! (Duh!) - that's why not permanent.

'SoS', Ken

Average of ratings: -