1

I am seeing the following in my "access_log":

ip.address.output.here - - [12/Dec/2019:15:17:07 +0000] "GET /pathto/article/15104133/?ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes&ineedthispage=yes HTTP/1.0" 200 817 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"

It is causing major performance problems with my website (apache2, php7.3.12, mySQL5.7.28ubuntu). What is is and how can I stop it from accessing my server? It is causing the error 504 Gateway Time-out.

  • 1
    Is this a WordPress site? When I Google ineedthispage=yes, the results suggest it may be associated with WordPress malware. – Stephen Ostermiller Dec 12 '19 at 17:26
  • Yes. It is a Wordpress site. What do I need to do to prevent this? – Neil Reardon Dec 12 '19 at 20:15
  • "what do I need to do to prevent this" check your site for malware. There are numerous security plugins. – Steve Dec 13 '19 at 5:17
1

It looks like it's Googlebot crawling your page which would mean that ineedthispage is somewhere on your website.

Check the page source if the link is there hidden, also link most likely starts with &ineedthispage without http:// so it is creating internal loop

If you use Chrome you can press

ctrl+u

To see the page source and then

ctrl+f

To search for that text on the page source

| improve this answer | |
  • Google search for the string indicates it may be malware related. If malware is causing it, it is unlikely to be in the page source. A lot of malware cloaks Googlebot. – Stephen Ostermiller Dec 13 '19 at 10:12
1

check the IP address source in WHOIS. IF it is not Google, then simply block the IP. Also, if the page does not exist, it would be worthwhile to add it, with an action of whatever IP address touches this page is automatically added to the block list for the site.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.