1

I am seeing the following in my "access_log":

ip.address.output.here - - [12/Dec/2019:15:17:07 +0000] "GET /pathto/article/15104133/?ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes HTTP/1.0" 200 817 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

It is causing major performance problems with my website (apache2, php7.3.12, mySQL5.7.28ubuntu). What is is and how can I stop it from accessing my server? It is causing the error 504 Gateway Time-out.

Improve this question
3
  • 1
    Is this a WordPress site? When I Google ineedthispage=yes, the results suggest it may be associated with WordPress malware.
    – Stephen Ostermiller ♦
    Commented Dec 12, 2019 at 17:26
  • Yes. It is a Wordpress site. What do I need to do to prevent this?
    – Neil Reardon
    Commented Dec 12, 2019 at 20:15
  • "what do I need to do to prevent this" check your site for malware. There are numerous security plugins.
    – Steve
    Commented Dec 13, 2019 at 5:17

2 Answers 2

Reset to default
1

It looks like it's Googlebot crawling your page which would mean that ineedthispage is somewhere on your website.

Check the page source if the link is there hidden, also link most likely starts with &ineedthispage without http:// so it is creating internal loop

If you use Chrome you can press

ctrl+u

To see the page source and then

ctrl+f

To search for that text on the page source

Improve this answer
1
  • Google search for the string indicates it may be malware related. If malware is causing it, it is unlikely to be in the page source. A lot of malware cloaks Googlebot.
    – Stephen Ostermiller ♦
    Commented Dec 13, 2019 at 10:12
1

check the IP address source in WHOIS. IF it is not Google, then simply block the IP. Also, if the page does not exist, it would be worthwhile to add it, with an action of whatever IP address touches this page is automatically added to the block list for the site.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.