[SOLVED] Abnormal traffic from localhost

gattu_marrudu · 2026-10-27 14:30:52

Hello,
I am running a very low-traffic Git server using Forgejo. Basically at the moment it's only my normal user and an admin user that I control. While the system is open to new registrations, the admin (me) needs to validate all new registration requests.

Today I noticed a much higher traffic to one of the Forgejo public projects, over 2 million requests per day. It used to be in the hundreds per day.

My setup: I have a bare metal local server with LXC. Forgejo runs on one of the VMs. I also have a forgejo-runner server for actions in a separate VM. The main host runs Nginx which is the gateway to Forgejo and all other apps, and where I keep all the web logs. The VM IP addresses are in the 10.0.3.x range.

Looking at the Nginx access logs:

192.168.1.1 - - [27/Oct/2026:10:05:32 -0400] "GET /ktx/pocket_archive/issues?assignee=2&labels=10%2C15%2C17%2C18%2C19%2C20%2C40%2C44%2C47&milestone=-1&poster=0&project=-1&state=open&type=all HTTP/1.1" 200 92622 "https://git.knowledgetx.com/ktx/pocket_archive/issues?assignee=2&labels=10%2C15%2C17%2C18%2C19%2C40%2C44%2C47&milestone=-1&poster=0&project=-1&state=open&type=all" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0"
192.168.1.1 - - [27/Oct/2026:10:05:32 -0400] "GET /ktx/pocket_archive/pulls?assignee=2&labels=15%2C17%2C18%2C20%2C22%2C23%2C47%2C52&milestone=5&poster=0&project=-1&state=all&type=all HTTP/1.1" 200 92896 "https://git.knowledgetx.com/ktx/pocket_archive/pulls?assignee=0&labels=15%2C17%2C18%2C20%2C22%2C23%2C47%2C52&milestone=5&poster=0&project=-1&state=all&type=all" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0"
192.168.1.1 - - [27/Oct/2026:10:05:32 -0400] "GET /ktx/pocket_archive/pulls?assignee=0&labels=16%2C18%2C42%2C43%2C52%2C65&milestone=2&poster=0&project=-1&state=all&type=all HTTP/1.1" 200 90678 "https://git.knowledgetx.com/ktx/pocket_archive/pulls?archived=false&assignee=0&labels=16%2C18%2C42%2C43%2C52&milestone=2&poster=0&project=-1&state=all&type=all" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"
192.168.1.1 - - [27/Oct/2026:10:05:32 -0400] "GET /ktx/pocket_archive/pulls?assignee=2&labels=14%2C15%2C16%2C18%2C21%2C22%2C23%2C43%2C47&milestone=3&poster=0&project=0&state=closed&type=all HTTP/1.1" 200 93460 "https://git.knowledgetx.com/ktx/pocket_archive/pulls?assignee=2&labels=14%2C15%2C16%2C18%2C21%2C22%2C43%2C47&milestone=3&poster=0&project=0&state=closed&type=all" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"
192.168.1.1 - - [27/Oct/2026:10:05:32 -0400] "GET /ktx/pocket_archive/issues?assignee=2&labels=9%2C18%2C19%2C22%2C23%2C39%2C43&milestone=3&poster=0&project=-1&state=closed&type=all HTTP/1.1" 200 90931 "https://git.knowledgetx.com/ktx/pocket_archive/issues?assignee=2&labels=9%2C18%2C19%2C22%2C23%2C39%2C43&milestone=3&poster=0&project=0&state=closed&type=all" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0"
192.168.1.1 - - [27/Oct/2026:10:05:32 -0400] "GET /ktx/pocket_archive/pulls?archived=false&assignee=0&labels=9%2C18%2C21%2C22%2C23%2C38%2C43%2C47%2C52&milestone=-1&poster=0&project=0&state=all&type=all HTTP/1.1" 200 92921 "https://git.knowledgetx.com/ktx/pocket_archive/pulls?assignee=0&labels=9%2C18%2C21%2C22%2C23%2C38%2C43%2C47%2C52&milestone=-1&poster=0&project=0&state=open&type=all" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
192.168.1.1 - - [27/Oct/2026:10:05:32 -0400] "GET /ktx/pocket_archive/issues?assignee=0&labels=10%2C19%2C20%2C23%2C40%2C44%2C52&milestone=-1&poster=0&project=-1&state=closed&type=all HTTP/1.1" 200 91035 "https://git.knowledgetx.com/ktx/pocket_archive/issues?labels=10%2C19%2C20%2C23%2C40%2C44%2C52&milestone=-1&poster=0&project=0&state=closed&type=all" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
192.168.1.1 - - [27/Oct/2026:10:05:32 -0400] "GET /ktx/pocket_archive/issues?assignee=0&labels=14%2C15%2C21%2C23%2C42%2C44%2C52%2C65&milestone=4&poster=0&project=-1&state=all&type=all HTTP/1.1" 200 91535 "https://git.knowledgetx.com/ktx/pocket_archive/issues?assignee=0&labels=14%2C15%2C21%2C23%2C42%2C44%2C52&milestone=4&poster=0&project=-1&state=all&type=all" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
192.168.1.1 - - [27/Oct/2026:10:05:32 -0400] "GET /ktx/pocket_archive/issues?archived=false&assignee=2&labels=15%2C18%2C39%2C47&milestone=3&poster=0&project=-1&state=closed&type=all HTTP/1.1" 200 88973 "https://git.knowledgetx.com/ktx/pocket_archive/issues?assignee=2&labels=15%2C18%2C39%2C47&milestone=3&poster=0&project=-1&state=all&type=all" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36"
192.168.1.1 - - [27/Oct/2026:10:05:32 -0400] "GET /ktx/pocket_archive/issues?archived=false&assignee=2&labels=9%2C17%2C19%2C21%2C22%2C38%2C43&milestone=-1&poster=0&project=-1&state=open&type=all HTTP/1.1" 200 90894 "https://git.knowledgetx.com/ktx/pocket_archive/issues?assignee=2&labels=9%2C17%2C19%2C21%2C22%2C38%2C43&milestone=-1&poster=0&project=-1&state=all&type=all" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"

Two things jumped right to my attention: 1) all requests come from localhost; and 2) they have different user agent signatures.

Could this be an internal DoS attack resulting from compromising my system?

What I tried and verified:

* Upgraded the system on the forgejo and forgejo-runner servers, and restarted them. I don't have PHP on either guest.
* Upgrading PHP on the one VM that I had it installed on. I was only able to do this a couple of days ago, as I was traveling with no access to my internal network while the PHP Shell vulnerability was announced.
* Stopped the runner service for a minute to see if it went rogue. The stream of requests continued while the runner is off.
* Stopped the forgejo service for a minute to see if it's looping. The requests kept coming, and got a 499 status code.
* Verified that there is no new user in the Forgejo app.

I am not sure now if one of my VMs was compromised and is being used as an attack agent, would the requests still show as coming from 192.168.1.1 even though the LXC guests are in the 10.0.3.x range?

Hints would be greatly appreciated!

Thanks,
gm

Last edited by gattu_marrudu (2026-10-27 18:46:33)

gattu_marrudu · 2026-10-27 15:17:01

Well, the 192.168.1.1 address seems to be a red herring. All my Nginx logs have that address as the requestor. So I need to fix that first.

My nginx configuration had no configuration for the log format, which I believe reverts to the default ("combined"). I added "combined" explicitly to the access log for that vhost, but the value of $remote_addr is still 192.168.1.1.

gattu_marrudu · 2026-10-27 15:19:39

Sorry. This was really dumb. 192.168.1.1 is my router, not the local host.

My router is running OpenWRT. Do I need to look to a particular firewall or NAT settings to show the actual remote requestor's IP?

mithrial · 2026-10-27 15:35:06

It looks like someone (a script, not a person) found your public instance and scrapes all the content or tries to run an attack.
It's your routers ip because you run it locally and the router forwards the incoming requests.

seth · 2026-10-27 15:37:20

https://superuser.com/questions/1851892 … in-openwrt
https://openwrt.org/docs/guide-user/fir … og_targets

gattu_marrudu · 2026-10-27 16:22:01

mithrial wrote:

It's your routers ip because you run it locally and the router forwards the incoming requests.

I'm trying to review my network rules. @seth I can't find any applicable solution in the link you suggest (one seems related to logging in OpenWRT, the other one involves an additional router).

If that's an OpenWRT issue, I will turn to their forum. Thanks.

seth · 2026-10-27 16:36:32

You'll have to log this on openwrt but its default behavior should™ actually be to preserve the remote IP and you'd have had to explicitly change that eg. to circumvent firewalls in the LAN.

dimich · 2026-10-27 17:07:34

gattu_marrudu wrote:

Do I need to look to a particular firewall or NAT settings to show the actual remote requestor's IP?

Usually routers forward port with DNAT, so local server will receive request from and log original source address.
In your case it looks like either SNAT or something running directly on the router and performing requests or userspace tunneling, something like 'socat tcp-listen:55555,fork tcp-connect:your_server_address:3000' or similar.

gattu_marrudu · 2026-10-27 18:46:21

This was a router issue indeed. I can deal with the bots with some throttling mechanisms now that I can see the individual IPs.

Closing. Thanks for the tips!

Arch Linux

#1 2026-10-27 14:30:52

[SOLVED] Abnormal traffic from localhost

#2 2026-10-27 15:17:01

Re: [SOLVED] Abnormal traffic from localhost

#3 2026-10-27 15:19:39

Re: [SOLVED] Abnormal traffic from localhost

#4 2026-10-27 15:35:06

Re: [SOLVED] Abnormal traffic from localhost

#5 2026-10-27 15:37:20

Re: [SOLVED] Abnormal traffic from localhost

#6 2026-10-27 16:22:01

Re: [SOLVED] Abnormal traffic from localhost

#7 2026-10-27 16:36:32

Re: [SOLVED] Abnormal traffic from localhost

#8 2026-10-27 17:07:34

Re: [SOLVED] Abnormal traffic from localhost

#9 2026-10-27 18:46:21

Re: [SOLVED] Abnormal traffic from localhost

Board footer